Fix CodeQL easy wins: missing-await + Dockerfile HEALTHCHECK

[keysersoft]

Summary

Part of the pre-launch CodeQL cleanup. Two small fixes that close two real alerts.

1. `packages/backend/src/settings/site-settings.controller.ts`

`getFooterLinks()` returned the unresolved Promise — `Promise || []` is always truthy so the `|| []` fallback was dead code. Now properly awaited so the empty-array fallback works.

Closes CodeQL alert #72 (`js/missing-await`).

2. `Dockerfile`

Added `HEALTHCHECK` pointing at the backend Terminus `/health` endpoint (port 4000). 30s interval, 5s timeout, 30s start period, 3 retries.

Closes CodeQL alert #3 (`DS-0026`) and gives Docker/K8s/Compose a proper liveness signal.

Test plan

• TypeScript compiles
• After merge: `docker inspect helpcodeai/anythingmcp` shows the Healthcheck stanza
• After merge: CodeQL alerts Improve first-user onboarding and email deliverability #72 and feat: upgrade major dependencies — OpenAI v6, Prisma v7, Next.js v16 #3 auto-close on next scan

Companion work (separate, not in this PR)

• 7 SQL injection alerts: dismissed as FPs (prepared queries with bind vars)
• 30 remote-property-injection alerts: dismissed as admin-only with prototype-pollution hardening tracked as a follow-up
• 5 request-forgery alerts: dismissed as guarded by `assertSafeOutboundUrl()` SSRF allowlist
• 7 ReDoS alerts: dismissed as bounded-input/admin-only
• 4 CVE alerts: 2 dismissed as not-in-our-tree, 2 left to Dependabot
• Helmet CSP, xss-through-exception, loop-bound-injection: dismissed with rationale
• 🚨 Open security issue (not in this PR): `login_user` cookie used by OAuth flow is base64-encoded but NOT HMAC-signed. Detailed in a separate report.