Wait on the container's own health, not the host's DNS

The app's health check ran on the target host against the container name, which
only resolves inside the Docker network, so the wait could never succeed. Poll
the image's HEALTHCHECK instead and fail with a readable message. Also pin
site.env to the app user when it exists, and say how to install the provisioning
script on the server.

menu-admin/readme.md

@@ -30,8 +30,12 @@ to the app repo, a new image, and a redeploy (ADR 0005).
 # 2. First run: a temporary hostname, so the live site keeps serving
 ansible-playbook -l monoco -e site=hopsngrains -e tag=2026-09-22 playbook.yml
 
-# 3. The admin needs a password before it can be used
-ssh monoco scripts/provision-site-env.sh /var/lib/menu-app.hopsngrains.com
+# 3. The admin needs a password before it can be used. The script lives in the
+#    app repo and writes site.env through a container running as the app user,
+#    so the SSH user never needs write access to the data root.
+scp scripts/provision-site-env.sh monoco:/tmp/
+ssh monoco bash /tmp/provision-site-env.sh /var/lib/menu-app.hopsngrains.com
+ssh monoco docker restart menu-app.hopsngrains.com
 ```
 
 The first run creates `/var/lib/menu-app.hopsngrains.com`, starts the container
@@ -45,7 +49,17 @@ so — the public menu still serves.
 
 ## Checking the parallel run
 
-From a phone on restaurant wifi, not from the server:
+`menu-new.hopsngrains.com` needs a DNS A record pointing at the same address as
+`menu.hopsngrains.com` before this runs: Caddy fetches a certificate for the
+name, which needs it to resolve publicly.
+
+Then, from the outside (read-only, exits non-zero on failure):
+
+```sh
+npm run check-site -- https://menu-new.hopsngrains.com
+```
+
+And from a phone on restaurant wifi, not from the server:
 
 - `https://menu-new.hopsngrains.com/` lists the Sections that have a current menu.
 - A Section page scrolls, the pour line tracks, tapping a page opens it full width.