[Feature]: Add independent Gatus status monitoring and external host heartbeats #32

Problem

The deployment story is improving around CI and backup verification, but there is still no independent operations layer that answers: "Is the deployed stack working right now?"

Existing issues cover adjacent reliability layers:

• [CI]: Add full-stack Docker Compose smoke tests through nginx #25 checks whether the stack works before deployment in CI
• [Feature]: Automatically verify backups by restoring them #24 checks whether backups can be restored after a failure
• [Feature]: Build and publish container images with SBOM and Cosign signing #23 improves the supply-chain/container publishing story

What is missing is runtime monitoring from outside the application process itself.

Proposed solution

Add independent status monitoring with Gatus and external host heartbeats.

Suggested scope:

• run Gatus outside the application stack, preferably as a host-level systemd service
• check Vault Web through the real public/VPN route
• check Cloud Page through the frontend/proxy path where possible
• check Vaultwarden
• check Vault Habits
• check a WebSocket endpoint or handshake path
• optionally add mail or notification checks if configured
• add an external heartbeat service such as healthchecks.io for host and backup jobs

Why outside the stack?

If monitoring only runs inside the same Docker Compose stack, it can fail at the same time as the services it is meant to observe. Keeping the first version independent makes it more useful for home-server operations.

Acceptance criteria

• deployment docs include a Gatus setup that runs independently from the main Docker Compose app stack
• checks cover Vault Web, Cloud Page, Vaultwarden, Vault Habits, and at least one WebSocket/real-time path
• checks exercise the same route a user would use, not only internal container ports
• external heartbeat checks are documented for host uptime and backup jobs
• alerting/failure behavior is documented clearly enough that a self-hosting user knows when action is needed
• the setup does not require making VPN-only services publicly reachable