Declare the healthcheck in Ansible instead of trusting the image

podman builds an OCI image by default and drops Docker's HEALTHCHECK instruction,
so the container had no health at all and the play failed waiting for one. The
check is now declared on the docker_container task - node is in the image and the
exec form needs no shell quoting - which is both what operators see in docker ps
and what an orchestrator would use.

The wait still asks the app directly rather than reading State.Health, because a
container that already exists is only rebuilt when the image tag changes or when
-e recreate_container=true is passed, and a wait must not depend on a container
attribute an existing one may not have.

ansible/roles/menu-app/tasks/main.yaml

@@ -42,6 +42,24 @@
     state: started
     restart_policy: unless-stopped
     user: '{{ app_uid }}:{{ app_gid }}'
+    # Force a rebuild of the container with -e recreate_container=true: that is
+    # what applies a changed healthcheck or env to an existing container, since
+    # the module otherwise leaves a running one alone.
+    recreate: '{{ recreate_container | default(false) | bool }}'
+    # Declared here rather than relied on from the image: podman builds an OCI
+    # image by default and drops Docker's HEALTHCHECK instruction, so the
+    # Dockerfile's own healthcheck never reaches the container. node is in the
+    # image and the exec form needs no shell quoting.
+    healthcheck:
+      test:
+        - CMD
+        - node
+        - -e
+        - "fetch('http://127.0.0.1:3000/healthz').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))"
+      interval: 30s
+      timeout: 5s
+      start_period: 30s
+      retries: 3
     env:
       MENU_ROOT: /data
       MENU_SITE_CONFIG: '/app/config/{{ site }}.site.json'