relay: bind 169.254.1.2 (host.containers.internal), not loopback

A socket bound to 127.0.0.1 refuses container traffic that arrives via
the podman bridge: the first live webhook failed with 'dial tcp
169.254.1.2:18093: connection refused'. The relay now binds the
host-gateway endpoint — link-local to the podman bridge, off the LAN —
and the deployer's health probe follows it there.

scripts/signal-relay.py

@@ -1,8 +1,8 @@
 #!/usr/bin/env python3
 """Alertmanager-to-Signal relay for the homelab (Dankclaw).
-
-Listens on 127.0.0.1:18093, receives Alertmanager's webhook payload, formats
-each alert group into a short message and hands it to signal-cli under the
+Listens on 169.254.1.2:18093 — the host side of host.containers.internal,
+the only address a bridge container can use to reach a host-local process —
+receives Alertmanager's webhook payload, formats
 existing account on this host. Runs as a systemd user unit
 (scripts/signal-relay.service); logs go to the journal.
 
@@ -20,7 +20,13 @@ import sys
 import time
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 
-LISTEN_ADDR = ("127.0.0.1", 18093)
+# 169.254.1.2 is the host endpoint of host.containers.internal: a socket
+# bound to 127.0.0.1 refuses container traffic that arrives via the podman
+# bridge (measured 2026-09-17: "dial tcp 169.254.1.2:18093: connection
+# refused"). The address is link-local to the podman bridge — not on any
+# LAN interface, not on loopback, reachable only from this host's
+# containers.
+LISTEN_ADDR = ("169.254.1.2", 18093)
 SIGNAL_CLI = "/usr/local/bin/signal-cli"
 SIGNAL_ACCOUNT = "318311"
 SIGNAL_TO = "+12062476336"