curl -sSI and Traefik probes use HEAD; the server only handled GET,
causing HEAD / to fall through to the 404 handler.

- Fix module.yml docker: section from object to list format so
  the builder actually builds and pushes the image
- Replace build: . with registry image reference in compose
- Fix certresolver name from letsencrypt to le
- Add explicit container_name, remove unused default network

Number guessing game (1-100, 7 attempts) as a HAL custom-app module.
Serves HTML form UI with per-session state via cookie, no npm deps.
Traefik labels for txt.${DOMAIN} on websecure with letsencrypt TLS.