Replace log-grep HEALTHCHECK with an in-process NATS health endpoint

Replace the docker/healthcheck.c log-grep probe with an in-process health signal each service answers directly: a NATS request/reply subject (e.g. ores.{tier}.{instance}.{service}.v1.health) that returns healthy once the service has registered its handlers – the same condition "Service ready." currently marks in the log – or, failing that, a minimal local socket the container's HEALTHCHECK connects to. Either way the container-level probe stops depending on log file contents and format staying stable, and stops needing a separate compiled binary per image just to parse them.

The current probe (added in the IAM per-service pilot, task) proves the HEALTHCHECK mechanism works end-to-end, but it's an external process reading a log file the service itself already knows the equivalent state of in memory – fragile (a log format/wording change silently breaks every container's health probe at once) and duplicative. Every service is already a NATS client and already has its own notion of "ready"; exposing that directly is a more robust, less coupled signal, and removes the need for ~docker/healthcheck.c~/the extra debian build stage entirely.

• Finish IAM per-service pilot: JWT signing failure and HEALTHCHECK – where the log-grep probe was first built, explicitly as a pragmatic first cut rather than a final design.
• docker/healthcheck.c

• Split ORE Studio services into one container per service