Fix the Quadlet healthcheck so the deploy gate can pass

podman builds an OCI image by default and drops the Dockerfile's HEALTHCHECK,
so the first deploy failed at "Wait for the container healthcheck to pass" with
"container ... has no defined healthcheck" even though the app was up.

- Declare the same check on the hops.container unit (HealthCmd + interval,
  timeout, retries, start period), the convention menu-admin already uses.
- Flush handlers right after starting, before the gate: the unit template's
  restart handler otherwise runs at the end of the play, so a run that changes
  only the unit would test the stale container.

ansible/roles/hops/tasks/main.yaml

@@ -86,6 +86,15 @@
       ansible.builtin.fail:
         msg: "Hops n Grains did not start — see the diagnostics above."
 
+# The unit template notifies "Restart Hops n Grains", but handlers otherwise run
+# at the very end of the play — after the healthcheck gate below. Flush them
+# here so the gate tests the container that has the current HealthCmd; without
+# this, a run that only changes the unit would check the stale container and
+# fail. On a run where nothing changed, no handler is pending and this is a
+# no-op.
+- name: Apply pending unit changes before verifying
+  ansible.builtin.meta: flush_handlers
+
 # Quadlet honours [Install] WantedBy= when it generates the unit, so
 # `systemctl --user enable` is neither needed nor possible on a generated unit.
 - name: Verify the Hops n Grains unit is active

ansible/roles/hops/templates/hops.container.j2

@@ -32,9 +32,14 @@ Volume={{ host_directory }}/pb_data:/app/pb_data
 # No PublishPort on purpose: the Docker-era deployment had none either, and
 # Caddy reaches both ports over {{ network_name }}_net.
 
-# The image's own HEALTHCHECK (PocketBase /api/health on {{ pb_port }} and the
-# site on {{ site_port }}) is used as is; the playbook gates on
-# `podman healthcheck run`.
+# podman builds an OCI image by default and drops the Dockerfile's HEALTHCHECK
+# instruction, so the same check is declared here and the play gates on it with
+# `podman healthcheck run`. curl is in the runner image.
+HealthCmd={{ health_cmd }}
+HealthInterval=15s
+HealthTimeout=3s
+HealthRetries=3
+HealthStartPeriod=5s
 
 [Service]
 Restart=always

ansible/vars/default.yml

@@ -41,6 +41,11 @@ host_directory: "{{ podman_data_dir }}/{{ container_name }}"
 site_port: 3000
 pb_port: 8090
 
+# The Dockerfile's HEALTHCHECK is dropped when podman builds an OCI image (its
+# default), so the same check is declared on the Quadlet unit and the play gates
+# on `podman healthcheck run`. curl is in the runner image.
+health_cmd: "curl -fsS http://127.0.0.1:{{ pb_port }}/api/health > /dev/null && curl -fsS http://127.0.0.1:{{ site_port }} > /dev/null"
+
 # Public hosts for frontend & PocketBase routing.
 host: www.hopsngrains.com
 apex_host: hopsngrains.com