fix(cac): healthcheck fails only on no answer or 5xx, not 4xx

curl -f also failed on 403/404, so a new site with an empty docroot showed
unhealthy forever and WHP's monitor restarted it as PHP wedged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -82,7 +82,12 @@ COPY ./configs/whp-security.conf /etc/httpd/conf.d/
 # Set up cron job in a single layer
 RUN echo "15 */12 * * * root /scripts/log-rotate.sh" >> /etc/crontab
 
+## Healthy = Apache answered with anything but a 5xx. `curl -f` also failed on
+## 4xx, so a new site with an empty docroot (403) or an app with no route for /
+## (404) showed unhealthy forever, and WHP's monitor restarted it as "PHP
+## wedged". 000 (no answer) and 5xx (PHP/app error) still fail.
 HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
-  CMD curl -f http://localhost/ || exit 1
+  CMD code=$(curl -s -o /dev/null -m 4 -w '%{http_code}' http://localhost/); \
+      case "$code" in 000|5*) echo "http $code"; exit 1;; esac
 
 ENTRYPOINT [ "/scripts/entrypoint.sh" ]