feat(ops): web + worker container healthchecks (#20)

docker-compose only health-checked db. Add:
- web: an unauthenticated GET /api/health (excluded from the auth middleware) +
  a compose healthcheck that hits it (node global fetch — no curl/wget in image).
- worker: a background daemon thread touches /tmp/worker.alive every ~15s
  (independent of the main loop, so it stays fresh through a long download) +
  a compose healthcheck on the file's mtime (unhealthy if >90s stale).

Now `docker compose ps` reports real health for all services.
worker 223 tests, web 154, tsc + build + compose config clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/src/app/api/health/route.ts

@@ -0,0 +1,5 @@
+// Unauthenticated liveness endpoint for the docker-compose healthcheck. Excluded from the
+// auth gate in middleware.ts.
+export function GET() {
+  return Response.json({ ok: true });
+}