No Docker healthchecks: the daemon keeps /metrics' counts itself (#218)

Docker runs a healthcheck with exec, and containerd puts each exec's state in XDG_RUNTIME_DIR,
/run/user/0 on Tower, which elogind removes when root's last session ends. Every check then
failed and every container showed unhealthy while all of them answered. The checks are gone from
the sample compose file and production's; ipx's library counts for /metrics, which only the
healthcheck's status call refreshed, are counted every 30 s by the daemon.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/skills/ipx-prod-check/SKILL.md

@@ -43,7 +43,7 @@ Start every check by seeing that all three run, since Loki cannot see a containe
 docker ps -a --filter name=iPX --filter name=ipx-web --filter name=ipx-directory --format '{{.Names}} {{.Status}}'
 ```
 
-All three should be `(healthy)`. Then work through ipx (the checks below), the page, the
+All three should be `Up`, with no recent restart; they have no Docker healthcheck (#218). Then work through ipx (the checks below), the page, the
 directory, Tower and the monitoring itself, in that order.
 
 ## ipx
@@ -226,8 +226,8 @@ a count says something happened, the lines and traces say why.
 
 Caddy logs one JSON line a request (#210), logger `http.log.access.log0`: Loki's `| json` gives
 `request_uri`, `request_method`, `request_remote_ip`, `status`, `duration` (seconds, not ms), `size`.
-The request's headers and a `?token=` are filtered out before it is written. Its healthcheck
-requests come from `127.0.0.1` every 30 s; leave them out. `/api` and `/media` pass on to ipx and
+The request's headers and a `?token=` are filtered out before it is written. Requests from
+`127.0.0.1` are local checks; leave them out. `/api` and `/media` pass on to ipx and
 are in ipx's own access log too, with ipx's time; Caddy's `duration` for them adds the hop.
 
 ```sh