fix(docker): healthcheck the port the app listens on

The HEALTHCHECK curled localhost:3300/health, but the app listens on 4000
(server.port in infra/*.yaml, EXPOSE 4000). The check always failed, so
deployment.sh waited on 'Waiting for healthcheck...', found the container
unhealthy and rolled back to an image with the same broken check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -15,6 +15,6 @@ COPY --from=build /out/app /app
 ENV TZ=Asia/Jakarta
 EXPOSE 4000
 HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
-  CMD curl -fsS http://localhost:3300/health || exit 1
+  CMD curl -fsS http://localhost:4000/health || exit 1
 USER appuser
 ENTRYPOINT ["/app"]