news-digest + chatterbox: fix unhealthy healthchecks (IPv6 fallback miss + missing curl)

Both reported (unhealthy) in docker ps. Two distinct root causes:

* news-digest-web: switched from nginx:alpine to python:3.12-alpine
  (uvicorn) but kept the wget healthcheck against `localhost`. Alpine's
  /etc/hosts maps localhost to BOTH ::1 and 127.0.0.1; busybox wget
  tries IPv6 first, hits "connection refused" because uvicorn binds
  IPv4-only, and doesn't fall back. Pinned to 127.0.0.1.

* chatterbox: devnen's image is built from a python:3.10 base and
  doesn't ship curl, so `curl -fsS http://localhost:8004/api/model-info`
  failed with `/bin/sh: 1: curl: not found`. Replaced with a python
  urllib one-liner that fetches + asserts `b'"loaded":true' in body`,
  also pinned to 127.0.0.1 to dodge the same IPv4/IPv6 race.

Both YAML extractions tested directly inside the running containers
(via `sh < script`) — chatterbox python check returns 0 when the model
is loaded.

stacks/chatterbox/compose.yaml

@@ -53,7 +53,13 @@ services:
       # /docs or /openapi.json to enumerate). /api/model-info returns
       # `{"loaded":true,...}` only after the model finishes loading,
       # so it doubles as a liveness + ready probe.
-      test: ["CMD-SHELL", "curl -fsS http://localhost:8004/api/model-info | grep -q '\"loaded\":true' || exit 1"]
+      #
+      # Use python urllib instead of curl: devnen's image is built
+      # from a python:3.10 base and doesn't ship curl. Bind 127.0.0.1
+      # explicitly — `localhost` on this image resolves to both ::1
+      # and 127.0.0.1, and uvicorn binds IPv4 only (busybox doesn't
+      # always retry on the v4 entry).
+      test: ["CMD-SHELL", "python3 -c \"import urllib.request,sys; b=urllib.request.urlopen('http://127.0.0.1:8004/api/model-info', timeout=5).read(); sys.exit(0 if b'\\\"loaded\\\":true' in b else 1)\""]
       interval: 30s
       timeout: 10s
       retries: 3

stacks/news-digest/compose.yaml

@@ -72,7 +72,12 @@ services:
     command: ["uvicorn", "web:app", "--host", "0.0.0.0", "--port", "80",
               "--no-access-log"]
     healthcheck:
-      test: ["CMD-SHELL", "wget -q -O /dev/null http://localhost/ || exit 1"]
+      # 127.0.0.1 instead of localhost — alpine's busybox wget tries
+      # IPv6 first when localhost resolves to both ::1 and 127.0.0.1
+      # (per /etc/hosts). uvicorn only binds 0.0.0.0 (IPv4), so the
+      # v6 attempt gets connection-refused and busybox doesn't fall
+      # back. Pin to v4 explicitly.
+      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
       interval: 30s
       timeout: 5s
       retries: 3