Backend health endpoints

The backend exposes unauthenticated health probes for operators and local preview tooling:

• GET /health/live returns 200 OK while the process is live.
• GET /health/ready returns 200 OK after startup completes and 503 Service Unavailable while the process is not ready.

Both endpoints send Cache-Control: no-store and a JSON body with a top-level status field (pass or fail) plus a checks object keyed by liveness or readiness.