Refine probes based on k3d cluster verification

Every chart was installed twice in a throwaway k3d cluster (origin/main
vs this branch) with real Postgres/Redis/dex instances and observed for
readiness ordering, stability and dependency-outage behavior. Findings:

- voucher-vault: Django only accepts Hosts 127.0.0.1 and the configured
  DOMAIN; the default probe Host (pod IP) always got 400. Probes now
  send 'Host: 127.0.0.1'.
- zipline: /api/healthcheck includes the database, so liveness now uses
  '/' (readiness/startup keep /api/healthcheck). Verified live: on a
  Postgres outage the pod turns NotReady within 30s and is never
  restarted by the kubelet.
- outline: '/' also returns 500 when the database is down, so there is
  no dependency-free endpoint; all three probes use /_health.

voucher-vault/values.yaml

@@ -13,11 +13,17 @@ voucherVault:
       cpu: 1
       memory: 384Mi
       ephemeral-storage: 100Mi
-  # "/" answers with a redirect for anonymous users, which httpGet treats as success.
+  # "/" answers with a redirect for anonymous users, which httpGet treats as
+  # success. The Host header must be set to 127.0.0.1 because Django's
+  # ALLOWED_HOSTS only accepts 127.0.0.1 and the configured DOMAIN — probing
+  # with the default Host (the pod IP) would always return 400.
   livenessProbe:
     httpGet:
       path: /
       port: http
+      httpHeaders:
+        - name: Host
+          value: 127.0.0.1
     periodSeconds: 10
     timeoutSeconds: 5
     failureThreshold: 3
@@ -25,6 +31,9 @@ voucherVault:
     httpGet:
       path: /
       port: http
+      httpHeaders:
+        - name: Host
+          value: 127.0.0.1
     periodSeconds: 10
     timeoutSeconds: 5
     failureThreshold: 3
@@ -33,6 +42,9 @@ voucherVault:
     httpGet:
       path: /
       port: http
+      httpHeaders:
+        - name: Host
+          value: 127.0.0.1
     periodSeconds: 5
     timeoutSeconds: 5
     failureThreshold: 30