fix(health): add /healthz route and tighten docker healthcheck

app/routes/healthz.tsx

@@ -0,0 +1,8 @@
+// Lightweight unauthenticated health check used by Docker/Caddy.
+// Returns 200 with a tiny JSON body. Do NOT touch the database here:
+// the goal is only to confirm the Node process is serving HTTP.
+export const loader = () =>
+  new Response(JSON.stringify({ ok: true }), {
+    status: 200,
+    headers: { "content-type": "application/json" },
+  });