fix(healthcheck): sweep localhost -> 127.0.0.1 across all 48 templates

BusyBox wget (+ node/python/curl one-shots, incl mealie's socket tuple) resolve
localhost -> IPv6 ::1 with no cross-family fallback; an IPv4-only-binding app
reads docker-unhealthy while serving (vaultwarden, re-run 2026-07-06). Escalates
that instance to the class. Scoped strictly to healthcheck test: lines
(diff-reviewed: no env/config/label changed; .felhom.yml already clean). New
REUSE.md convention row.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 2026-07-06 — healthcheck sweep: `localhost` → `127.0.0.1` across all 48 templates
+
+Escalation of the re-run vaultwarden observation
+(`felhom.eu/documentation/audits/RERUN-p1p3-2026-07-06.md`) from an instance to a **class**: 48/53
+templates used `localhost` in their docker healthcheck `test:` line. BusyBox `wget` (and the node /
+python / curl one-shot forms, incl. mealie's `socket.create_connection`) resolve `localhost`→IPv6
+`::1` with no cross-address-family fallback, so an IPv4-only-binding app reads docker-`unhealthy`
+while fully serving. Mechanical sweep `localhost`→`127.0.0.1`, scoped strictly to the healthcheck
+`test:` lines (diff-reviewed: no app env/config/label line changed; `.felhom.yml` files were already
+clean). Industry practice — never `localhost` in container healthchecks. New REUSE.md convention row.
+
 ## 2026-07-06 — vaultwarden F1 fix: _ENABLE_SMTP boot-gate (campaign finding, pilot-blocking)
 
 The no-mercy campaign (felhom.eu `audits/CAMPAIGN-nomercy-2026-07-06.md`, finding F1) proved that a