Zero-downtime deploys for a small web app

Design how a small company deploys its web app without users noticing. The app runs as 4 identical server instances behind a load balancer, uses one Postgres database, and handles about 300 requests a second at peak, some of them file uploads that take up to a minute. The team deploys about 10 times a week. Today every deploy restarts all servers at once and users see errors for about 30 seconds, and a bad deploy last month took an hour to roll back. Describe the health checks, the rollout process, how database schema changes fit in, and how a bad release is detected and rolled back.