Keep checkout alive through an AZ failure

Checkout disappeared when one Availability Zone failed. The stack already has a load balancer and an Auto Scaling group, but both are pinned to the same zone and instance replacement only notices EC2 failures.

Repair checkout-stack.yaml so the load balancer and Auto Scaling group span both supplied zones and replace unhealthy application instances after a 120-second startup grace period.

• The application reports healthy at /health with HTTP 200; keep minimum and desired capacity 2 and maximum 4.
• Preserve the network, traffic path, security groups, and private-only instances.