ops-sidecar: add autoheal (AUTOHEAL_CONTAINER_LABEL=all) — fleet-wide standard

Restarts any container that goes unhealthy, giving the 'healthcheck on every
container' convention teeth (previously only mediapvr had autoheal, and in
opt-in label mode = inert). Raw docker.sock RW (restart needs POST; can't use
the read-only socket-proxy). Sweep 2b.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

roles/dawarich/templates/docker-compose.yml.j2

@@ -160,6 +160,20 @@ services:
       OTP_ENCRYPTION_KEY_DERIVATION_SALT: "{{ dawarich_otp_salt }}"
       BACKGROUND_PROCESSING_CONCURRENCY: "{{ dawarich_sidekiq_concurrency }}"
 
+  # autoheal — restarts any container that goes unhealthy (fleet ops-sidecar standard)
+  autoheal:
+    image: willfarrell/autoheal:latest
+    container_name: autoheal
+    restart: unless-stopped
+    environment:
+      - AUTOHEAL_CONTAINER_LABEL=all
+      - AUTOHEAL_INTERVAL=15
+      - AUTOHEAL_START_PERIOD=60
+      - AUTOHEAL_DEFAULT_STOP_TIMEOUT=30
+      - TZ=America/Toronto
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+
   watchtower:
     container_name: dawarich_watchtower
     image: ghcr.io/nicholas-fedor/watchtower:latest