Add a health check for the daemon and RPC endpoint (#34)

* Add a health check for the daemon and RPC endpoint

SeafileClient.is_healthy() checks seaf-cli status and makes a real RPC
call (get_repo_list) against the daemon's Unix socket - neither needs
the Seafile server, so it works without a token or password.

healthcheck.py exposes it as a plain script for Docker's HEALTHCHECK.
Each check is a fresh process spawned by the Docker daemon as root,
unlike the long-lived start.py process, so it drops to the seafile
user with runuser before touching the RPC socket - the one place that
mechanism still belongs after the earlier in-process privilege drop.

Verified against the real image: healthcheck.py exits 0 once the real
daemon is up (through the actual main() entrypoint, not a test
fixture) and nonzero when no daemon has been started.

* Assert the return value in the daemon-down health check test

Copilot review: the test checked the RPC call was skipped but not
what is_healthy() actually returned in that case.

---------

Co-authored-by: Maxim Shulga <maxim.shulga@alludo.com>

IMPROVEMENTS.md

@@ -208,7 +208,12 @@ Acceptance criteria:
 - [x] Reject UID or GID zero unless a documented use case requires it.
   `main()` now exits with code 2 and a clear message if `--uid`/`SEAFILE_UID`
   or `--gid`/`SEAFILE_GID` resolve to 0, before `setup_uid()` ever runs.
-- [ ] Add a health check for the daemon and RPC endpoint.
+- [x] Add a health check for the daemon and RPC endpoint.
+  `SeafileClient.is_healthy()` checks `seaf-cli status` and a real RPC call
+  (`get_repo_list`); `healthcheck.py` exposes it to Docker's `HEALTHCHECK`.
+  Each check is a fresh root-spawned process (unlike the long-lived
+  `start.py`), so it drops to the `seafile` user with `runuser` before
+  touching the RPC socket - the one place that mechanism still belongs.
 - [ ] Handle temporary RPC failures and daemon restarts without corrupting
   state.
 - [ ] Document supported CPU architectures instead of implying multi-platform