fix: healthcheck uses credentials — container was marked unhealthy

/_up returns 401 when require_valid_user = true, so curl -f always
failed, Docker marked the container unhealthy, and Traefik refused to
route traffic to it (causing the 404 on couchdb.manohargupta.com).

Switch to CMD-SHELL so the shell can expand $COUCHDB_USER /
$COUCHDB_PASSWORD from the container's environment at runtime.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

obsidian-sync/docker-compose.yml

@@ -34,8 +34,10 @@ services:
     # docker inspect shows OOMKilled:false — misleading). Re-add once swap < 50%.
 
     healthcheck:
-      # _up is CouchDB's lightweight liveness endpoint (no auth needed).
-      test: ["CMD", "curl", "-f", "http://localhost:5984/_up"]
+      # _up requires auth because require_valid_user = true covers all endpoints.
+      # CMD-SHELL lets the container shell expand $COUCHDB_USER/$COUCHDB_PASSWORD
+      # (the $$ in YAML becomes $ after Compose substitution, then the shell runs it).
+      test: ["CMD-SHELL", "curl -f -u $$COUCHDB_USER:$$COUCHDB_PASSWORD http://localhost:5984/_up"]
       interval: 30s
       timeout: 10s
       retries: 5