Bind 0.0.0.0 to IPv4 only (closes #528)

Go listens on any unspecified address with one socket that answers
IPv4 and IPv6, so BIND_ADDRESS=0.0.0.0 also bound every IPv6 address,
which the README says it does not. The listener now uses tcp4 for an
IPv4 address; :: still binds both. The server's start hook suppresses
contextcheck, as the other start hooks do.

The image's health check asked for localhost, which wget reached over
::1 only. It now asks for the container's own address from hostname
-i, which a 0.0.0.0 or :: bind answers and a loopback bind does not.
The README drops the bindv6only condition from :: (Go sets that
socket option itself) and names an ss check.

Model: opus-5-5

Dockerfile

@@ -274,8 +274,12 @@ EXPOSE 8080
 # port.
 ENV BIND_ADDRESS=0.0.0.0
 
+# The probe requests the container's own address, not loopback, so a
+# listener that answers only on loopback (an empty or loopback
+# BIND_ADDRESS) fails it. hostname -i prints one IPv4 address per
+# network the container is on; the first is enough.
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-    CMD wget --no-verbose --tries=1 --spider http://localhost:8080/.well-known/healthcheck || exit 1
+    CMD wget --no-verbose --tries=1 --spider "http://$(hostname -i | cut -d ' ' -f 1):8080/.well-known/healthcheck" || exit 1
 
 ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
 CMD ["/app/webhooker"]