feat: what a token's HEALTH folder is sent under a custom health model

[over2take]

systemBuilder/healthView.js works out the view, and the socket's requestHealthView sends it to the asker alone. Whoever may change the token's health (the GM, a player granted editing, the token's owner) gets the full detail: a second track's numbers, box marks, harm notes, the wound penalty, location notes. Everyone else gets a description only: a fill, light against heavy, the worst harm's name, WOUNDED, which locations are hurt. An NPC's owner field never grants the full view. Over the socket because that is where a player's identity is known in every mode.

Actions also report what the window needs to say: how many boxes turned heavier, and which level harm landed on. A second track's maximum is set on the sheet; every other SET MAX stays on the token as before.

Summary

Test plan

• Tested locally
• Tests pass

Pre-merge checklist

Code quality:

• Code follows project style
• No breaking changes (or clearly documented)
• No console errors or warnings

Version & Release:

• Version bumped? If releasing to users, update:
  • frontend/package.json version
  • docker-compose.yml APP_VERSION
  • CHANGELOG.md with release notes
• GitHub Actions will auto-tag Docker images with the new version

Before merging to main:

• All tests passing
• PR reviewed and approved
• Branch is up to date with main
• No merge conflicts

Related issues