Make the healthcheck a command Quadlet can pass through

The first deploy put all three Sites up serving and permanently unhealthy: every
healthcheck run died with `/bin/sh: syntax error: unterminated quoted string`.
The unit file carried the closing quote, but podman's stored config did not.
Quadlet's parser strips a trailing double quote, so `node -e "fetch(...)"`
reached the container as an unterminated shell string. The sibling apps never hit
this because their HealthCmd is a bare `curl`.

The check is now `wget -q -O /dev/null http://127.0.0.1:<port>/healthz` — busybox
wget, no quoting, non-zero on anything but a 2xx — and the Dockerfile's own
HEALTHCHECK says the same thing. The vars comment, the unit template and the
deployment readme all say why it has to stay quote-free.

Found from the running container rather than the play output: `podman
healthcheck run` returned 1, `.State.Health.Log` held the sh error, and the app
log showed it listening on 127.0.0.1:3000 the whole time.

ansible/roles/menu-app/templates/menu-app.container.j2

@@ -40,7 +40,8 @@ Network={{ network_name }}.network
 
 # podman builds an OCI image by default and drops the Dockerfile's HEALTHCHECK
 # instruction, so the same check is declared here and the play gates on it with
-# `podman healthcheck run`. node is in the image.
+# `podman healthcheck run`. wget is busybox's; see vars/default.yml for why the
+# command must not contain quotes.
 HealthCmd={{ health_cmd }}
 HealthInterval=30s
 HealthTimeout=5s