fix: deploy crash from MutableHeaders.pop + missing wget

Two issues blocked the security-fix deploy:

1. Starlette's MutableHeaders has no .pop() — del-via-membership is the
   correct mapping op. The previous code crashed every request with
   AttributeError, taking the container's healthcheck down with it.

2. Coolify's in-container healthcheck falls back to wget which wasn't
   installed in our slim base. Add wget alongside curl.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nadlan_mcp/web_app.py

@@ -338,8 +338,10 @@ def create_app() -> FastAPI:
         response.headers.setdefault(
             "Strict-Transport-Security", "max-age=31536000; includeSubDomains"
         )
-        # Drop the server-version banner.
-        response.headers.pop("server", None)
+        # Drop the server-version banner — MutableHeaders has no .pop(),
+        # use the mapping protocol instead.
+        if "server" in response.headers:
+            del response.headers["server"]
         # Cache hashed asset bundles aggressively (Vite already adds a hash
         # to filenames so cache invalidation is a build problem, not a
         # runtime one). Everything else: don't cache.