Fix the Quadlet healthcheck so the deploy gate can pass

podman builds an OCI image by default and drops the Dockerfile's HEALTHCHECK,
so the first deploy failed at "Wait for the container healthcheck to pass" with
"container ... has no defined healthcheck" even though the app was up.

- Declare the same check on the hops.container unit (HealthCmd + interval,
  timeout, retries, start period), the convention menu-admin already uses.
- Flush handlers right after starting, before the gate: the unit template's
  restart handler otherwise runs at the end of the play, so a run that changes
  only the unit would test the stale container.

ansible/vars/default.yml

@@ -41,6 +41,11 @@ host_directory: "{{ podman_data_dir }}/{{ container_name }}"
 site_port: 3000
 pb_port: 8090
 
+# The Dockerfile's HEALTHCHECK is dropped when podman builds an OCI image (its
+# default), so the same check is declared on the Quadlet unit and the play gates
+# on `podman healthcheck run`. curl is in the runner image.
+health_cmd: "curl -fsS http://127.0.0.1:{{ pb_port }}/api/health > /dev/null && curl -fsS http://127.0.0.1:{{ site_port }} > /dev/null"
+
 # Public hosts for frontend & PocketBase routing.
 host: www.hopsngrains.com
 apex_host: hopsngrains.com