Make the healthcheck a command Quadlet can pass through

The first deploy put all three Sites up serving and permanently unhealthy: every
healthcheck run died with `/bin/sh: syntax error: unterminated quoted string`.
The unit file carried the closing quote, but podman's stored config did not.
Quadlet's parser strips a trailing double quote, so `node -e "fetch(...)"`
reached the container as an unterminated shell string. The sibling apps never hit
this because their HealthCmd is a bare `curl`.

The check is now `wget -q -O /dev/null http://127.0.0.1:<port>/healthz` — busybox
wget, no quoting, non-zero on anything but a 2xx — and the Dockerfile's own
HEALTHCHECK says the same thing. The vars comment, the unit template and the
deployment readme all say why it has to stay quote-free.

Found from the running container rather than the play output: `podman
healthcheck run` returned 1, `.State.Health.Log` held the sh error, and the app
log showed it listening on 127.0.0.1:3000 the whole time.

ansible/vars/default.yml

@@ -48,11 +48,15 @@ site_port: 3000
 
 # podman builds an OCI image by default and drops the Dockerfile's HEALTHCHECK
 # instruction, so the same check is declared on the Quadlet unit and the play
-# gates on `podman healthcheck run`. node is in the image, and the sh -c podman
-# wraps it in handles the quotes.
-health_cmd: >-
-  node -e "fetch('http://127.0.0.1:{{ site_port }}/healthz').then(r =>
-  process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"
+# gates on `podman healthcheck run`.
+#
+# The command must not contain quotes. Quadlet's parser strips a trailing double
+# quote from HealthCmd, so `node -e "fetch(...)"` reaches podman as an
+# unterminated string and every check dies with "/bin/sh: syntax error:
+# unterminated quoted string" — the container serves, and is permanently
+# unhealthy. wget is busybox's, needs no quoting, and exits non-zero on anything
+# but a 2xx.
+health_cmd: 'wget -q -O /dev/null http://127.0.0.1:{{ site_port }}/healthz'
 
 # ---------------------------------------------------------------------------
 # Shared Caddy unit (caddy/playbook.yml in the ansible-playbooks repo)