Expose metrics and a health check

[jbpratt]

modbot had no way to answer "is it alive right now" other than typing in chat and waiting. This adds /metrics and /healthz on :9090, a keepalive PING to drive connection state, and a container HEALTHCHECK so a wedged bot gets restarted instead of sitting there.

Four metrics, deliberately:

Metric	Why
modbot_connected	the one that matters — ws death, expired cookie, crash-loops
modbot_last_message_received_timestamp_seconds	chat traffic, informational only
modbot_ws_reconnects_total	climbing = dial succeeds but session rejected, usually the cookie
modbot_command_persist_failures_total	an !addcommand acknowledged and then lost

Plus go_* / process_* free from client_golang. Nothing is labelled by nick — unbounded cardinality, and it would turn the metrics store into a record of user behaviour.

Health is the socket being up, not chat being busy

Gating on time-since-last-message would restart the bot for being quiet at 4am. SendPing fails when the socket is gone, so a ping write landing is the signal. The PONG is never read, which also sidesteps dggchat's parsePing base64-decoding the payload and listen() silently skipping the handler when that fails.

An expired cookie is still caught: the server closes the socket, the read errors, onSocketError fires, modbot_connected drops and ws_reconnects climbs.

Notes

• The image is FROM scratch, so HEALTHCHECK runs the binary's own -healthcheck mode. Verified baked into the image as ["CMD","/modbot","-healthcheck"].
• No ports are published. Scraping happens by container name over the existing strims docker network, so hooks/redeploy needs no change.
• Image grows 9.9 MB -> 16.5 MB from client_golang.
• Nothing scrapes this yet. Merging changes nothing observable except that docker ps starts showing a health status. The collector stack is the next piece of work.

⚠️ modbot-cd.yaml deploys on push to master, so merging this ships it.