build: container health check, licence in the image, CI hardening

HEALTHCHECK via noitu-server -healthcheck; the root LICENSE ships next
to NOTICE and the CI image check requires it; .claude and .env files
stay out of the build context. CI uses go-version stable, runs
govulncheck and npm audit, checks out without persisted credentials, and
proto.yml moves off the archived buf-setup-action. dependabot.yml is
dropped; the audit steps are the dependency signal. deployment.md gains
the Coolify/Traefik recipe, the stop-grace rule, the hello deadline and
per-address room budget, and the suppressed-log counter.

.github/workflows/proto.yml

@@ -19,19 +19,21 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           # buf breaking compares against main, which needs real history.
           fetch-depth: 0
 
-      # A moving version rather than an exact pin, per house rule: updates
-      # arrive on the next run, and a breaking major would surface here before
-      # it could surprise a contributor's own machine.
-      - uses: bufbuild/buf-setup-action@v1
+      # No version input, so the newest buf is used rather than an exact pin,
+      # per house rule: updates arrive on the next run, and a breaking major
+      # would surface here before it could surprise a contributor's own
+      # machine.
+      - uses: bufbuild/buf-action@v1
         with:
-          version: latest
+          setup_only: true
 
       - uses: actions/setup-go@v5
         with:
-          go-version-file: server/go.mod
+          go-version: stable
           cache-dependency-path: server/go.sum
 
       - uses: actions/setup-node@v4