Give Core its own health check

[SaladDay]

What

• oac-core healthcheck probes Core's own /healthz on 127.0.0.1; compose.yaml runs it as Core's healthcheck.
• oac-web healthcheck now probes only Web's own listener.
• The default console origin follows the Web port: ${OAC_PUBLIC_URL:-http://localhost:${OAC_WEB_PORT:-8080}}.
• Docs (EN + zh) and scripts/compose-smoke.py updated (the smoke now uses a fixed free loopback port and asserts the upgraded default origin follows it).

Why

Audit-core 3a, 5(ii), 7: Web's health implied Core's, so after a long Core outage the first rerun / oac apply failed on Web's stale unhealthy and only the next succeeded. up --wait now waits on each service directly. The installer (oac) only runs up --wait, so it needs no change. processconfig only gets a doc-comment update, since healthcheck also calls Load.

Verification

• go vet ./... (core, web): pass
• go test services/core/cmd/server, internal/processconfig, services/web: pass (new tests: Core and Web healthcheck probe only their own listener)
• python3 -m unittest deploy/compose/test_compose.py: pass (new origin cases)
• scripts/check-names.py: pass; zh source_hash values verified

Skipped

• Local compose-smoke.py: the host cannot reach gcr.io to build the images; CI's compose job covers it.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}