Harden api-proxy startup healthcheck to reduce early unhealthy flaps (#2155)

* Initial plan

* fix: harden api-proxy startup healthcheck timing

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/44091053-b674-4a52-9925-6638b3defeff

* test: keep api-proxy healthcheck assertions type-safe

Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/9a7c100d-699a-4d82-b62e-f1af7fcd53a4

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>

Author: Copilot

src/docker-manager.test.ts

@@ -2365,7 +2365,11 @@ describe('docker-manager', () => {
         const result = generateDockerCompose(configWithProxy, mockNetworkConfigWithProxy);
         const proxy = result.services['api-proxy'];
         expect(proxy.healthcheck).toBeDefined();
-        expect((proxy.healthcheck as any).test).toEqual(['CMD', 'curl', '-f', 'http://localhost:10000/health']);
+        const healthcheck = proxy.healthcheck!;
+        expect(healthcheck.test).toEqual(['CMD', 'curl', '-f', 'http://localhost:10000/health']);
+        expect(healthcheck.timeout).toBe('2s');
+        expect(healthcheck.retries).toBe(10);
+        expect(healthcheck.start_period).toBe('10s');
       });
 
       it('should drop all capabilities', () => {

src/docker-manager.ts

@@ -1773,9 +1773,9 @@ export function generateDockerCompose(
       healthcheck: {
         test: ['CMD', 'curl', '-f', `http://localhost:${API_PROXY_HEALTH_PORT}/health`],
         interval: '1s',
-        timeout: '1s',
-        retries: 5,
-        start_period: '2s',
+        timeout: '2s',
+        retries: 10,
+        start_period: '10s',
       },
       // Security hardening: Drop all capabilities
       cap_drop: ['ALL'],