Top-level supervisor for hecate-om.

Owns three workers, all shared by the hosting service: 1. hecate_om_identity — keeps the realm cert + UCAN cached 2. hecate_om_capabilities — fans capability advertisements out 3. hecate_om_health — bookkeeping for /health responses

and, when health_port is configured, the Cowboy listener that actually serves GET /health on it (so Podman's HEALTHCHECK and k8s liveness probes have something to hit).