docker: web container reaps zombies; zim and help healthchecks can pass

Caddy is PID 1 in the web container and reaps nothing.  The healthcheck's
busybox `wget --spider https://...` forks an `ssl_client` helper that is
orphaned to caddy and stays a zombie, one per check.  `init: true` runs
tini as PID 1 so they are reaped.

The zim healthcheck calls curl, which the debian:13 kiwix image does not
install, so every check exited 127.  The help healthcheck probed port
8086, which is Caddy's HTTPS proxy on the web container; mkdocs serves
on port 80 inside its own container.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docker-compose.yml

@@ -130,6 +130,9 @@ services:
       # Set EXTRA_SANS to include the host's LAN IP in the TLS certificate.
       # Example: EXTRA_SANS=IP:10.0.0.5
       - EXTRA_SANS=${EXTRA_SANS:-}
+    # Caddy is PID 1 and reaps nothing; busybox wget's ssl_client helper from the healthcheck is
+    # orphaned to it and stays a zombie (one per check).  init runs tini as PID 1 to reap them.
+    init: true
     healthcheck:
       test: [ 'CMD-SHELL', 'wget --spider --no-check-certificate https://127.0.0.1:443 || exit 1' ]
       interval: 1m
@@ -165,5 +168,5 @@ services:
     volumes:
       - './docker/help/wrolpi-help:/opt/wrolpi-help'
     healthcheck:
-      test: [ 'CMD-SHELL', 'curl http://127.0.0.1:8086' ]
+      test: [ 'CMD-SHELL', 'curl http://127.0.0.1:80' ]  # mkdocs serves on 80; 8086 is Caddy's proxy.
       interval: 1m

docker/zim/Dockerfile

@@ -1,7 +1,8 @@
 FROM debian:13
 ENV DOCKER=true
 
-RUN apt update && apt-get install -y kiwix kiwix-tools
+# curl is for the compose healthcheck.
+RUN apt update && apt-get install -y kiwix kiwix-tools curl
 
 # Committed blobs (e.g. the default Zim served when the media directory has no
 # functioning zim files).