relay: bind 169.254.1.2 (host.containers.internal), not loopback

A socket bound to 127.0.0.1 refuses container traffic that arrives via
the podman bridge: the first live webhook failed with 'dial tcp
169.254.1.2:18093: connection refused'. The relay now binds the
host-gateway endpoint — link-local to the podman bridge, off the LAN —
and the deployer's health probe follows it there.

shared/prometheus/alertmanager.yml

@@ -2,7 +2,8 @@
 # Deployed to /opt/alertmanager/config/alertmanager.yml on Dankclaw.
 #
 # The one delivery path is Signal. The webhook lands on the host-side
-# signal-relay (a systemd user unit listening on 127.0.0.1:18093), which
+# signal-relay (a systemd user unit listening on 169.254.1.2:18093, the
+# host.containers.internal endpoint), which
 # formats the group and hands it to signal-cli under Frank's existing
 # account. There is deliberately no second receiver: a duplicate channel is
 # how an alert starts arriving twice and getting muted everywhere.