Refine probes based on k3d cluster verification

Every chart was installed twice in a throwaway k3d cluster (origin/main
vs this branch) with real Postgres/Redis/dex instances and observed for
readiness ordering, stability and dependency-outage behavior. Findings:

- voucher-vault: Django only accepts Hosts 127.0.0.1 and the configured
  DOMAIN; the default probe Host (pod IP) always got 400. Probes now
  send 'Host: 127.0.0.1'.
- zipline: /api/healthcheck includes the database, so liveness now uses
  '/' (readiness/startup keep /api/healthcheck). Verified live: on a
  Postgres outage the pod turns NotReady within 30s and is never
  restarted by the kubelet.
- outline: '/' also returns 500 when the database is down, so there is
  no dependency-free endpoint; all three probes use /_health.

outline/templates/outline.sfs.yaml

@@ -80,8 +80,10 @@ spec:
             - containerPort: 3000
               protocol: TCP
               name: http
-          # Outline exposes a dedicated health endpoint at /_health
-          # (also used by the upstream Docker HEALTHCHECK).
+          # Outline exposes a dedicated health endpoint at /_health (also used
+          # by the upstream Docker HEALTHCHECK). It checks Postgres and Redis;
+          # there is no dependency-free HTTP endpoint ("/" returns 500 too when
+          # the database is down), so all three probes use /_health.
           livenessProbe:
             httpGet:
               path: /_health