chore(docker): add HEALTHCHECK to pngx-controller-ts sidecar

wget --spider on 127.0.0.1:8000 verifies the Tailscale
sidecar's network namespace is forwarding to the backend
(controller shares the ts container's network ns).
start_period=60s covers Tailscale auth + tailscaled boot.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docker-compose.yml

@@ -17,6 +17,12 @@ services:
       - NET_ADMIN
       - NET_RAW
     restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "wget --spider -q http://127.0.0.1:8000/ || exit 1"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 60s
     networks:
       - default
       - domverse