fix(decidim): probe with the host Rails will answer for

The healthcheck curls http://127.0.0.1:3000/up, and the role's own
initializer, templates/allowed_hosts.rb.j2, appends the public domain to
`config.hosts`. What that append does depends on RAILS_ENV (Rails 7.2.2.2,
railties/lib/rails/application/configuration.rb:39-42 and
default_middleware_stack.rb:16-17):

- development starts from `.localhost`, `.test`, 0.0.0.0/0 and ::/0, so
  loopback stays allowed and the append changes nothing;
- production starts from an empty list, so the append switches host
  authorization on with the domain as its only entry, and the probe gets 403.

Job 102705651823 of run 34421944328 shows both. Its regular deploy runs
RAILS_ENV=development and is healthy with no blocked request. Its nested
instructions deploy runs RAILS_ENV=production and never becomes healthy; the
first probe that reaches Rails is already refused:

    E, [2026-09-10T03:47:10.424204 #1] ERROR -- : [ActionDispatch::HostAuthorization::DefaultResponseApp] Blocked hosts: 127.0.0.1:3000
    curl: (22) The requested URL returned error: 403

118 such lines in total, until `Decidim | Wait for web container to be
healthy` (60 x 15s) gives up. The container itself is fine: migrations ran
and Puma is listening on 0.0.0.0:3000.

The curl flavor sends a Host header when `hostname` is set
(utils/docker/healthcheck/probes.py:54-55); decidim never declared one. It
now sends the same `lookup('domain', 'web-app-decidim')` that vars/main.yml
feeds into the initializer, which production accepts as its one entry and
development accepts anyway.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/web-app-decidim/meta/services.yml

@@ -30,6 +30,7 @@ decidim:
   healthcheck:
     flavor: curl
     path: up
+    hostname: "{{ lookup('domain', 'web-app-decidim') }}"
   modes:
     compose:
       enabled: true