Make the healthcheck a command Quadlet can pass through

The first deploy put all three Sites up serving and permanently unhealthy: every
healthcheck run died with `/bin/sh: syntax error: unterminated quoted string`.
The unit file carried the closing quote, but podman's stored config did not.
Quadlet's parser strips a trailing double quote, so `node -e "fetch(...)"`
reached the container as an unterminated shell string. The sibling apps never hit
this because their HealthCmd is a bare `curl`.

The check is now `wget -q -O /dev/null http://127.0.0.1:<port>/healthz` — busybox
wget, no quoting, non-zero on anything but a 2xx — and the Dockerfile's own
HEALTHCHECK says the same thing. The vars comment, the unit template and the
deployment readme all say why it has to stay quote-free.

Found from the running container rather than the play output: `podman
healthcheck run` returned 1, `.State.Health.Log` held the sh error, and the app
log showed it listening on 127.0.0.1:3000 the whole time.

Dockerfile

@@ -33,7 +33,11 @@ EXPOSE 3000
 # Quadlet unit declares the same check again as HealthCmd= (see
 # ansible/roles/menu-app/templates/menu-app.container.j2). Keeping it here means
 # the image still healthchecks itself when run directly.
+#
+# The check is deliberately quote-free: a Quadlet HealthCmd that ends in a double
+# quote loses it, so the unit would run an unterminated shell string. wget is
+# busybox's and exits non-zero on anything but a 2xx.
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s \
-  CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+  CMD wget -q -O /dev/null http://127.0.0.1:${PORT:-3000}/healthz
 
 CMD ["node", "src/server.ts"]