komga: fix healthcheck — probe unauthenticated /actuator/health (was 401 on /api/v1/...)

The /api/v1 prefix is auth-gated → old HC got 401 → curl -f failed → container
reported unhealthy while serving fine. Diagnosed live on guest 9201.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -0,0 +1,10 @@
+# Changelog
+
+## 2026-06-22 — komga healthcheck fix (unattended test campaign)
+- **komga**: healthcheck probe repointed `/api/v1/actuator/health` → `/actuator/health`.
+  - Root cause: komga's Spring Boot actuator endpoint is served unauthenticated at `/actuator/health`
+    (HTTP 200), while everything under the `/api/v1` prefix is auth-gated — so the old probe got
+    HTTP 401, `curl -f` exited 22, and the container reported `unhealthy` despite serving normally
+    on :25600. Diagnosed live on guest 9201 (probe matrix: `/`, `/actuator/health`,
+    `/api/v1/oauth2/providers`, `/login` all 200; `/api/v1/actuator/health` → 401).
+  - The `gotson/komga:1.20.0` image ships `curl` (verified), so the probe tool is unchanged.

templates/komga/docker-compose.yml

@@ -35,8 +35,12 @@ services:
       resources:
         limits:
           memory: 512M
+    # HC override: komga's actuator lives at /actuator/health (unauthenticated, 200), NOT under the
+    # auth-gated /api/v1 API prefix — the old /api/v1/actuator/health returns 401 so `curl -f` failed
+    # (exit 22) and the container reported "unhealthy" despite serving fine. The gotson/komga image
+    # ships curl (verified), so curl -f on the unauthenticated endpoint is the correct probe.
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:25600/api/v1/actuator/health"]
+      test: ["CMD", "curl", "-f", "http://localhost:25600/actuator/health"]
       interval: 30s
       timeout: 5s
       retries: 3