fix: verify deployment health in Docker host network

scripts/deploy-unraid.sh

@@ -15,6 +15,11 @@ if [ ! -d /mnt/user/dev/hope-voice-api/certs ]; then
     --mount type=bind,source=/mnt/user/dev/hope-voice-api/certs,target=/certs,readonly \
     hope-voice-api-voice:latest -d /certs
 fi
+# The runner also has its own loopback network. Probe the host namespace through
+# a short-lived container, without exposing private control endpoints on the LAN.
+host_curl() {
+  docker run --rm --network host --entrypoint curl hope-voice-api-voice:latest "$@"
+}
 STAMP=$(date -u +%Y%m%dT%H%M%SZ)
 BACKUP="$ROOT/rollback/$STAMP"
 mkdir -p "$BACKUP"
@@ -70,7 +75,7 @@ docker run -d --name hope-control --network host --restart unless-stopped \
   -v /var/run/docker.sock:/var/run/docker.sock \
   --log-opt max-size=10m --log-opt max-file=3 hope-voice-control:latest >/dev/null
 for attempt in $(seq 1 30); do
-  if curl -sf http://127.0.0.1:8092/health -o /dev/null; then break; fi
+  if host_curl -sf http://127.0.0.1:8092/health -o /dev/null; then break; fi
   if [ "$attempt" = 30 ]; then false; fi
   sleep 2
 done
@@ -87,6 +92,6 @@ for attempt in $(seq 1 30); do
   if [ "$attempt" = 30 ]; then false; fi
   sleep 2
 done
-test "$(curl -sk -o /dev/null -w '%{http_code}' -X POST https://127.0.0.1:9178/token)" = 401
+test "$(host_curl -sk -o /dev/null -w '%{http_code}' -X POST https://127.0.0.1:9178/token)" = 401
 trap - ERR
 printf 'Deployment healthy; rollback containers retained with suffix %s\n' "$STAMP"