🩹 Fix healthcheck to verify real HTTP response, not just process/port 🩹

Adds a hand-crafted env fragment so the Docker HEALTHCHECK actually
confirms Forgejo is serving HTTP, not just that its process exists and
its port shows up in netstat. Found via a beta-test pass: a container
could report "healthy" for a brief window right after `docker restart`
while external requests still got connection resets.

- rootfs/usr/local/etc/docker/env/10-healthcheck.sh: new hand-crafted
  env fragment (sourced by entrypoint.sh on every invocation, including
  the HEALTHCHECK probe) that sets HEALTH_ENDPOINTS to Forgejo's own
  /api/healthz endpoint, so entrypoint.sh's healthcheck case performs a
  real curl -f check via __curl in addition to its existing process and
  port checks. No [generated] file touched.
- TODO.AI.md: updated the healthcheck TODO entry to record this fix and
  what it verified, and to note a residual, out-of-scope-here gap — the
  Dockerfile's HEALTHCHECK --interval=5m means Docker can still show a
  stale "healthy" status for up to 5 minutes after a restart even with
  a correct check; closing that needs a shorter --start-interval on the
  generated HEALTHCHECK line, which must be changed upstream in the
  gen-dockerfile template repo, not here.

rootfs/usr/local/etc/docker/env/10-healthcheck.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# shellcheck shell=bash
+# - - - - - - - - - - - - - - - - - - - - - - - - -
+# Hand-crafted runtime env fragment (never touched by gen-dockerfile).
+# Sourced by /usr/local/bin/entrypoint.sh on every invocation, including
+# the Docker HEALTHCHECK probe.
+#
+# Without this, the healthcheck only checks that the forgejo process is
+# running and that its port shows up in the container's own netstat
+# output — both of which can be true for a brief window before the web
+# server is actually accepting and answering HTTP requests, so Docker
+# reports "healthy" before external clients can reliably connect (seen
+# right after `docker restart`; logged in TODO.AI.md).
+#
+# Setting HEALTH_ENDPOINTS makes the same healthcheck also require a
+# real successful HTTP response from Forgejo itself, closing that race.
+# - - - - - - - - - - - - - - - - - - - - - - - - -
+HEALTH_ENDPOINTS="${HEALTH_ENDPOINTS:-http://127.0.0.1:${FORGEJO_PORT:-80}/api/healthz}"