Dockerfile: add HEALTHCHECK for serve mode operational health

[bluet]

Goal

Add a HEALTHCHECK instruction to the Dockerfile so users running proxybroker serve in container orchestrators (Docker Swarm, Kubernetes, ECS) get accurate health signals without writing a custom probe.

Why this is in scope

Two scanners flag this:

• Checkov CKV_DOCKER_2: 'Ensure that HEALTHCHECK instructions have been added to container images'
• Operational quality for the serve-mode use case — k8s readinessProbe / livenessProbe needs SOMETHING to check.

The serve-mode image listens on a TCP port. A trivial nc/curl against 127.0.0.1:\ (or the default 8888) is sufficient to detect 'process running and accepting connections'.

Scope

HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
    CMD nc -z 127.0.0.1 ${PROXYBROKER_PORT:-8888} || exit 1

(Or equivalent using curl if added to base image, but nc is in slim Debian.)

Acceptance criteria

1. docker inspect bluet/proxybroker2:next shows Healthcheck config block.
2. docker run --rm bluet/proxybroker2:next serve --host 0.0.0.0 --port 8888 reports HEALTHY after start_period.
3. Without serve mode (e.g., docker run --rm ... find ...), HEALTHCHECK is irrelevant (find exits before interval); not a regression.
4. Checkov CKV_DOCKER_2 no longer flags the Dockerfile.

Out of scope

• USER non-root setup (CKV_DOCKER_3) — separate ticket; affects more than just serve mode.
• Multi-stage healthcheck for find/grab modes — those are short-lived; HEALTHCHECK doesn't fit.

Estimated effort

~30 minutes including documentation update.