Stop the health wait from failing a healthy deploy, and clear a stale address

The first real deploy left the site on 502 and this is why. podman builds an OCI
image by default and drops the Docker HEALTHCHECK instruction, so the app
container has no State.Health at all; the role waited on that field, exhausted
its retries and failed the play, so the caddy role never ran and Caddy kept
proxying menu.hopsngrains.com to the old nginx container that is now gone.

The wait now asks the app itself: docker exec node -e fetch /healthz, which needs
no healthcheck and no DNS. And because the address may still be claimed by the
snippet the retired nginx-menu playbook wrote, the caddy role drops that marker
before writing its own - two blocks for one address make Caddy refuse the config,
and a refused reload quietly leaves the old proxy in place.

check-site also asked for the font the old design used, so it would have failed a
healthy site; it checks one we ship.

scripts/check-site.ts

@@ -55,7 +55,7 @@ await checkPage('/robots.txt', ['Disallow: /admin']);
 await checkPage('/admin/login', ['type="password"']);
 await checkPage('/assets/styles.css', ['--copper']);
 await checkPage('/assets/app.js', ['data-zoom']);
-await checkPage('/assets/fonts/archivo-latin.woff2', []);
+await checkPage('/assets/fonts/playfair-display-latin.woff2', []);
 
 const missingPage = await request('/definitely-not-here');
 record('GET /definitely-not-here', missingPage.status === 404, `status ${missingPage.status}`);