fix(web-app-bridgy-fed): declare status_codes.default so hlth-webserver accepts the by-design 404 on /

bridgyfed.infinito.example serves HTTP 404 on / by design — the
canonical landing surfaces are federation-protocol endpoints
(/robots.txt, /.well-known/host-meta, /web/<actor>), not a generic
homepage. The Playwright spec encodes this contract (5xx is the
only unhealthy signal), but meta/server.yml never declared a
status_codes override. The sys-ctl-hlth-webserver systemd probe
therefore expected DEFAULT_OK = [200, 302, 301] from
web_health_expectations.py and consistently saw 404 — the unit
went into failed state, sys-service-terminator retried 10× over
~10 min, and the deploy aborted with "Final-run service failed:
hlth-webserver.7.0.0.infinito.nexus.service".

The unrelated openresty "[crit] connect() to unix:/var/run/docker.sock
failed (13: Permission denied)" warnings come from the Prometheus
Lua background poller in roles/web-app-prometheus/templates/nginx/
prometheus.conf.j2 and are pre-existing log noise — they neither
caused this failure nor were introduced by 55c1bceeb.

Follows the existing override pattern in roles/web-svc-html/meta/server.yml
and roles/web-app-listmonk/meta/server.yml.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

roles/web-app-bridgy-fed/meta/server.yml

@@ -3,6 +3,8 @@ domains:
   canonical:
     - bridgyfed.{{ DOMAIN_PRIMARY }}
   aliases: []
+status_codes:
+  default: [200, 301, 302, 404]
 csp:
   whitelist: {}
   flags: {}