fix(ansipa): reliable nginx + keycloak healthchecks

Both containers were reporting "unhealthy" while serving fine — the
healthchecks I added probed the wrong address/endpoint:

- nginx: `wget localhost` resolves to IPv6 ::1 inside the container, but nginx
  listens on IPv4 0.0.0.0:80 only, so the probe was refused. Use 127.0.0.1.
- keycloak: with KC_HTTP_RELATIVE_PATH=/auth, /health/ready on the 9000
  management port returns 404. Probe /auth/realms/master on the serving port
  8080 instead (bash /dev/tcp — the image has no curl/wget).

Verified all five containers report healthy and the gateway serves /, /ipa/ui/,
/cmk/ and /auth/ correctly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MUhrcFU8J1Hnf7vNqNxZNi

setup/modules/FreeipaAnsible/image/docker-compose.yml

@@ -233,11 +233,12 @@ services:
     networks:
       ipa-net:
     healthcheck:
-      # The official Keycloak image ships neither curl nor wget, and since
-      # KC 25 the health endpoints live on the management port (9000) and are
-      # only served when KC_HEALTH_ENABLED=true. Use bash's /dev/tcp instead
-      # of curl so the check works inside the stock image.
-      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/9000 && echo -e 'GET /health/ready HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && grep -q '\"status\": \"UP\"' <&3"]
+      # The official Keycloak image ships neither curl nor wget (but has bash),
+      # so probe with bash's /dev/tcp. Check the actual serving port under the
+      # configured relative path (/auth) rather than the 9000 management
+      # /health endpoint — with KC_HTTP_RELATIVE_PATH set, /health/ready on 9000
+      # returns 404, whereas /auth/realms/master reliably returns 200 once up.
+      test: ["CMD-SHELL", "exec 3<>/dev/tcp/127.0.0.1/8080 && printf 'GET /auth/realms/master HTTP/1.1\\r\\nHost: localhost\\r\\nConnection: close\\r\\n\\r\\n' >&3 && head -c 15 <&3 | grep -q '200 OK'"]
       interval: 20s
       timeout: 10s
       retries: 20
@@ -276,7 +277,10 @@ services:
     networks:
       ipa-net:
     healthcheck:
-      test: ["CMD-SHELL", "wget -qO- http://localhost/ >/dev/null 2>&1 || exit 1"]
+      # Use 127.0.0.1, not localhost: inside the container localhost resolves to
+      # IPv6 ::1, but nginx listens on IPv4 0.0.0.0:80 only, so a localhost probe
+      # is refused even though the gateway is serving fine.
+      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
       interval: 30s
       timeout: 10s
       retries: 10