fix: address review feedback for health check endpoints

- Install wget in Web Dockerfile for compose healthcheck
- Ensure HttpListener response is always closed in BotHealthCheckHostedService
- Use ephemeral port in Bot health check test to avoid port conflicts
- Rename NpgsqlHealthCheck test to reflect actual behavior

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/GmRelay.Bot/Infrastructure/Health/BotHealthCheckHostedService.cs

@@ -72,10 +72,10 @@ public sealed class BotHealthCheckHostedService : IHostedService
 
     private async Task HandleRequestAsync(HttpListenerContext context)
     {
+        var response = context.Response;
         try
         {
             var request = context.Request;
-            var response = context.Response;
 
             if (request.Url?.AbsolutePath == "/health")
             {
@@ -88,12 +88,14 @@ public sealed class BotHealthCheckHostedService : IHostedService
             {
                 response.StatusCode = (int)HttpStatusCode.NotFound;
             }
-
-            response.Close();
         }
         catch (Exception ex)
         {
             _logger.LogError(ex, "Error handling health check request");
         }
+        finally
+        {
+            response.Close();
+        }
     }
 }

src/GmRelay.Web/Dockerfile

@@ -18,7 +18,7 @@ RUN dotnet publish "GmRelay.Web.csproj" -c Release -o /app/publish /p:UseAppHost
 # Stage 2: Runtime
 FROM mcr.microsoft.com/dotnet/aspnet:10.0-noble AS final
 WORKDIR /app
-RUN apt-get update && apt-get install -y --no-install-recommends libgssapi-krb5-2 && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends libgssapi-krb5-2 wget && rm -rf /var/lib/apt/lists/*
 COPY --from=build /app/publish .
 RUN mkdir -p /app/dataprotection-keys && chown -R $APP_UID:$APP_UID /app/dataprotection-keys
 ENV ASPNETCORE_URLS=http://+:8080