DC-061: Add healthCheckUrl override to URL resolver

Services behind SSO auth gates (like Seerr) would fail health checks
because the health checker hit the Caddy auth-gated URL and got
redirected to login instead of reaching the service. The healthCheckUrl
field in services.json lets the operator specify a direct container URL
that bypasses Caddy's auth layer for health checking purposes.

Priority order in resolveServiceUrl():
  1. internet → fixed google.com
  2. healthCheckUrl → direct container URL (NEW)
  3. isExternal + externalUrl
  4. service.url
  5. dnsServers config
  6. fallback buildServiceUrl()

Verified on DNS2: Seerr health check now hits http://127.0.0.1:5055
directly instead of https://requests.sami through the SSO gate.

dashcaddy-api/src/utilities/url-resolver.js

@@ -9,10 +9,11 @@
  *
  * Priority:
  *   1. internet → https://www.google.com
- *   2. isExternal + externalUrl → use as-is
- *   3. service.url → prepend https:// if no protocol
- *   4. dnsServers config → http://{ip}:{port}
- *   5. fallback → buildServiceUrl(id)
+ *   2. healthCheckUrl → use as-is (bypass SSO/Caddy for direct container health checks)
+ *   3. isExternal + externalUrl → use as-is
+ *   4. service.url → prepend https:// if no protocol
+ *   5. dnsServers config → http://{ip}:{port}
+ *   6. fallback → buildServiceUrl(id)
  *
  * @param {string} id - service identifier
  * @param {Object|null} service - service object from services.json (may be null for top-card services)
@@ -22,6 +23,7 @@
  */
 function resolveServiceUrl(id, service, siteConfig, buildServiceUrl) {
   if (id === 'internet') return 'https://www.google.com';
+  if (service?.healthCheckUrl) return service.healthCheckUrl;
   if (service?.isExternal && service.externalUrl) return service.externalUrl;
   if (service?.url) return service.url.startsWith('http') ? service.url : `https://${service.url}`;
   const dnsServer = siteConfig?.dnsServers?.[id];