Fix config and variable mismatches found in the audit

content/en/3.serveex/3.security/4.pocket-id.md

@@ -63,7 +63,7 @@ services:
     ports:
       - 1411:1411
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:1411/healthz"]
+      test: ["CMD", "/app/pocket-id", "healthcheck"]
       interval: 90s
       timeout: 5s
       retries: 3
@@ -111,7 +111,7 @@ Pocket ID doesn't use passwords: your first account is created with a **passkey*
 
 ::note
 
-Since `APP_URL` is already set to your future public domain, passkey registration may ask you to open Pocket ID from that domain instead. Expose it first (see below) if setup doesn't complete locally.
+Passkeys require a secure context: HTTPS, or `localhost`. Registering one from `http://yourserverip:1411` on another machine will be refused by the browser, since that's plain HTTP to a non-`localhost` address. If setup doesn't complete locally, expose Pocket ID first (see below) and finish setup over HTTPS instead.
 ::
 
 ## Exposing Pocket ID with Swag