fix: make wordpress healthcheck production safe

docs/runbook.md

@@ -6,6 +6,23 @@
 2. Run `docker compose --profile tools run --rm wp-cli /scripts/bootstrap.sh`.
 3. Inspect `docker compose logs wordpress db` without printing secret values.
 
+## WordPress stays in waiting or unhealthy
+
+1. Inspect `docker compose logs wordpress db` without printing secret values.
+2. Confirm the database volume was initialized with the same `MARIADB_DATABASE`,
+   `MARIADB_USER`, and password currently configured in `.env`.
+3. Confirm `WP_URL` has the intended scheme and hostname. In production it should be
+   the public HTTPS URL.
+4. Rebuild after changes to the WordPress image:
+
+   ```bash
+   docker compose up --build -d wordpress
+   ```
+
+The WordPress healthcheck is internal and does not depend on the public DNS/TLS route.
+It sends the configured host and forwarded protocol headers to avoid following external
+HTTPS redirects during production startup.
+
 ## NGINX returns 502
 
 1. Run `docker compose ps` and `docker compose exec proxy nginx -t`.