[tajanthind]

Problem (found during post-merge live verification)

The accounts lockdown (merged #45) gates every /api/* route behind a login. The container healthcheck probed http://localhost:4688/api/artists, which now returns 403, so a freshly deployed container reports unhealthy even though the app is running perfectly:

$ docker ps --filter name=fnack
... (unhealthy)
$ docker inspect --format '{{json .State.Health}}' fnack   # /api/artists -> 403

Fix

Probe /health — the always-open liveness endpoint (app.py /health, and it is in the accounts guard's open-path list):

• Dockerfile: image-level HEALTHCHECK → /health
• docker-compose.yml: healthcheck.test → /health

Both carry a comment explaining why /api/* must not be probed.

Regression test

tests/architecture/test_accounts_first_run.py::test_container_healthcheck_probes_an_open_endpoint — asserts every container health probe in the Dockerfile and compose targets /health and never a login-gated /api/ route.

Verification

• Accounts arch test file passes (now 6 tests including the new one).
• Live: the running container was recreated with an equivalent runtime healthcheck override (--health-cmd "curl -f http://localhost:4688/health") and reports healthy; this PR makes the baked-in healthcheck correct so no override is needed.