fix: harden downloads, settings, and UI edge cases

- Integrate DownloadRegistry into concurrent download limit
  and clean up timers on removal/clear
- Wrap MetadataSyncService batch deletes in single transaction
- Always re-throw checksum errors in RuffleService to prevent
  verification bypass
- Fix system-settings early return skipping second job update
  when first cron expression is invalid
- Increase DatabaseService hot-reload grace period to 30s
- Add permission guard to metadata sync status endpoint
- Use encodeURIComponent for game launch content URLs
- Clamp limit params to minimum of 1 in jobs routes
- Use non-null assertion for authenticated user permissions
- Fix ConfirmDialog not calling onCancel on overlay dismiss
- Guard FormattedDate against invalid date strings
- Add breadcrumbContext to GameListItem memo comparison
- Fix MetadataUpdateCard stale closure in interval callback
- Move Dockerfile healthcheck to docker-compose for flexibility
- Fix build:analyze script to set VITE_ANALYZE env var

frontend/Dockerfile

@@ -62,9 +62,8 @@ RUN chown -R nginx:nginx /usr/share/nginx/html && \
 # Expose port (8080 for non-root user)
 EXPOSE 8080
 
-# Health check (using wget which is built into Alpine)
-HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
-  CMD wget --quiet --spider http://localhost:8080/ || exit 1
+# Health check is configured in docker-compose.yml for flexibility.
+# When running standalone (docker run), add --health-cmd manually.
 
 # Run as non-root user (nginx user from base image)
 USER nginx