fix: social-preview images + absolute URLs + OCI-safe healthcheck

[kallioli]

Context

Sharing a Ghostbit link (iMessage, Slack, …) rendered a huge blown-up logo:
og:image pointed at the portrait logo (421×548) via a relative URL, so
unfurl bots stretched it into the hero-image slot.

Rebuilding the image to ship that fix surfaced a second issue: podman build
produces OCI-format images, which silently drop the Dockerfile HEALTHCHECK
("not supported for OCI image format") — the liveness probe was effectively
absent from every podman-built image.

Changes

Social previews

• New static/og-banner.png (1200×630) — landscape social card
• New static/icon.png (512×512) — square favicon + apple-touch-icon
• Homepage: og:image → banner, absolute URL, width/height/type/alt, twitter:card=summary_large_image
• Paste pages: drop og:image so unfurls fall back to the compact card (an encrypted paste has nothing to preview)
• Favicon / apple-touch-icon redirects → the square icon

Absolute URLs

• New BASE_URL setting + abs_url() template helper: og:image / og:url use BASE_URL when configured, else the request origin
• Hardens absolute URLs behind a TLS-terminating proxy that would otherwise advertise an internal http:// origin
• Documented in .env.example, README, docs/configuration.md; a malformed value fails fast at startup

Healthcheck

• Remove HEALTHCHECK from the Dockerfile (dropped by OCI builds anyway)
• Add a healthcheck: block to the ghostbit service in docker-compose.yml
• Add Health* keys to the Podman Quadlet example in the README
• Probe targets 127.0.0.1, not localhost: busybox wget resolves localhost to [::1], but uvicorn binds IPv4 only — the original localhost probe never actually worked

Tests

• ruff check + ruff format --check clean, 84/84 pytest pass (+3 new: og:image is absolute, paste page omits og:image, abs_url BASE_URL override)
• Rendered meta verified live (homepage = banner, paste = compact, absolute URLs)
• Image rebuilt with podman — no OCI warning, podman healthcheck run → healthy
• og-banner.png / icon.png served 200 from inside the container

Risks

• Low — no API / storage / crypto changes; the server-never-sees-plaintext invariant is untouched.
• Link-unfurl caches (iMessage/Slack/Facebook) are per-URL and sticky: previously shared links may show the old preview for a while; new links pick up the new card immediately.