Wait on the container's own health, not the host's DNS

The app's health check ran on the target host against the container name, which
only resolves inside the Docker network, so the wait could never succeed. Poll
the image's HEALTHCHECK instead and fail with a readable message. Also pin
site.env to the app user when it exists, and say how to install the provisioning
script on the server.

menu-admin/roles/menu-app/tasks/main.yaml

@@ -53,15 +53,35 @@
     networks:
       - name: "{{ docker_network }}"
 
-- name: Wait for the app to answer
-  uri:
-    url: "http://{{ docker_container }}:3000/healthz"
-    status_code: 200
+- name: Keep site.env readable only by the app user
+  file:
+    path: "{{ app_root }}/site.env"
+    owner: "{{ app_uid }}"
+    group: "{{ app_gid }}"
+    mode: "0600"
+  when: menu_site_env.stat.exists
+
+- name: Wait for the app to report healthy
+  # The image's own HEALTHCHECK fetches /healthz inside the container. Polling
+  # that is deliberate: a container name resolves only on the Docker network, so
+  # the host cannot fetch http://{{ docker_container }}:3000/healthz.
+  docker_container_info:
+    name: "{{ docker_container }}"
   register: menu_health
-  retries: 10
-  delay: 2
-  until: menu_health.status == 200
   changed_when: false
+  retries: 20
+  delay: 5
+  until: >-
+    menu_health.container is defined and
+    menu_health.container.State.Health is defined and
+    menu_health.container.State.Health.Status == 'healthy'
+
+- name: Fail when the app never becomes healthy
+  fail:
+    msg: >-
+      {{ docker_container }} did not report healthy within 100s. Check
+      `docker logs {{ docker_container }}`.
+  when: menu_health.container.State.Health.Status | default('unknown') != 'healthy'
 
 - name: Check the data directory for integrity problems
   # Reads the same directory the container writes, as the same user, so a