Add self-hosted Healthchecks stack for internal job monitoring (hybrid)

Self-hosted Healthchecks (ops/healthchecks/) as the hub for internal
cron/job heartbeats. The three host-down/backup watchdogs (Borg pre-hook,
baerchen nearline pull, monitoring watchdog #8) deliberately stay on
healthchecks.io cloud, since an on-host watcher cannot report a host outage.

- frontend_net + dedicated PostgreSQL 18 in healthchecks_internal
- native Healthchecks auth; ping/API exempt from Authelia (n8n/Komodo pattern)
- registered as middleware_exempt in ops/policy-checks/exceptions.json
- docs: DECISIONS, ARCHITECTURE (3.1/4.2/7.6/10), SERVICE_CATALOG,
  SECRETS_MAP, MASTER_TODO, README index

docker compose config validated (exit 0). Not yet deployed: host secret file,
appdata dir, Komodo stack + ENV and Gitea webhook remain operator steps.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/README.md

@@ -57,6 +57,7 @@ geloescht (Git-Historie ist das Archiv). Verbindliche Doku-Regeln:
 | `RENOVATE.md` | Self-hosted Renovate gegen Gitea |
 | `runbooks/komodo-bulk-deploy-dns.md` | Bulk-Deploy-Pulls scheitern an DNS bei AdGuard-Recreate |
 | `../ops/h-drive-nearline/README.md` | Windows-H:/ Nearline-Pull fuer kritische Restore-Artefakte |
+| `../ops/healthchecks/README.md` | Self-hosted Healthchecks (interne Job-Heartbeats); externe Host-down-/Backup-Waechter bleiben Cloud |
 
 ## Nutzer- und Statusdoku