library: BIND_ADDR for loopback-only mode, real readiness check

- BIND_ADDR (default 0.0.0.0) on every published port; 127.0.0.1 keeps the
  stack reachable from the host only (Docker bypasses ufw, so this is the
  actual control the kiosk addon's 'this kiosk only' choice uses)
- Koha serves its web-installer page with HTTP 200 before the database
  exists, so 'port answers' was not 'ready': the entrypoint now writes
  /run/koha-ready, the healthcheck requires it, and install.sh waits for
  healthy + the quick-add health endpoint

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013wi3ZSot4XbUViwRFgLpRf

library/koha/Dockerfile

@@ -35,6 +35,6 @@ RUN chmod 0755 /opt/koha-init/entrypoint.sh && chmod -R a+rX /opt/koha-init
 
 EXPOSE 80 8081
 VOLUME ["/var/lib/koha"]
-HEALTHCHECK --interval=30s --timeout=10s --start-period=300s --retries=5 \
-  CMD curl -fsS -o /dev/null http://127.0.0.1:80/ && curl -fsS -o /dev/null http://127.0.0.1:8081/ || exit 1
+HEALTHCHECK --interval=10s --timeout=10s --start-period=300s --retries=6 \
+  CMD test -f /run/koha-ready && curl -fsS -o /dev/null http://127.0.0.1:80/ && curl -fsS -o /dev/null http://127.0.0.1:8081/ || exit 1
 ENTRYPOINT ["/opt/koha-init/entrypoint.sh"]

library/koha/entrypoint.sh

@@ -15,6 +15,10 @@ export TZ="${TZ:-UTC}"
 
 log() { echo "[koha-init] $*"; }
 
+# Marker the container healthcheck waits for. Before the database exists Koha
+# serves its web-installer page with HTTP 200, so "port answers" is not "ready".
+rm -f /run/koha-ready
+
 # --- 1. memcached (Koha caches sysprefs and sessions in it) -----------------
 memcached -u memcache -m 64 -d
 cron
@@ -105,5 +109,6 @@ apache2ctl -k stop >/dev/null 2>&1 || true
 for i in 1 2 3 4 5; do pgrep -x apache2 >/dev/null || break; sleep 1; done
 rm -f /var/run/apache2/apache2.pid
 
+touch /run/koha-ready
 log "ready - library catalogue on :80, staff interface on :$STAFF_PORT"
 exec apache2ctl -D FOREGROUND