anubis: fix image ref typo in deploy pull, health probe exec form, unit alias tag

Three compounding deploy-handler bugs found by live deployment:
- podman image exists/pull used a mixed-case ghcr.io ref that podman's
  reference parser rejects before any network I/O (repository name must be
  lowercase); all refs now lowercase — ghcr resolves case-insensitively.
- the unit runs the image under a localhost/ alias tag: this host's podman
  5.7 quadlet path fails container create with 'image not known' for
  registry-prefixed refs even when present in storage (verified live).
- the health probe was shell-form and the distroless ko-build image has no
  shell; HealthCmd is now a JSON exec-form array, which passes through the
  quadlet generator's argv assembly verbatim.

Tests updated to assert the alias-tag reality plus the pull guard.

serverAppConfigs-docs/index.md

@@ -71,6 +71,7 @@ covers both workloads).
 - [[LAN-DNS]] — name resolution, Pi-hole, router DNS hand-off
 - [[Pi-hole]] — the LAN DNS server (quadlet, records, web UI)
 - [[Caddy]] — reverse proxy and TLS
+- [[Anubis]] — bot challenge proxy fronting the guarded vhosts (chain, policy, gotchas)
 - [[Authentik]] — the homelab's SSO / OIDC provider (forward_auth)
 - [[authentik-postgres]] — Authentik database service
 - [[authentik-server]] — Authentik server + Caddy outpost service