feat(proxy): add /health endpoint for liveness checks

[emretinaztepe]

Summary

Adds a local GET /health endpoint to wardgate-proxy so sidecars (e.g. the Fleet sandbox boot sequence) can confirm the proxy is up and serving HTTP before it starts trusting the proxy with sealed credentials.

What it does

• Mounts an http.ServeMux in wardgate-proxy that handles GET /health locally with a small JSON payload ({"status":"ok","service":"wardgate-proxy","version":"…"}).
• All other paths continue to flow through the existing ReverseProxy handler — no behavior change for real traffic.
• The endpoint performs no upstream call and requires no agent key, so it's safe to expose on the listen socket.
• HEAD /health returns 200 with no body; non-GET/HEAD methods get 405 with Allow: GET, HEAD.

Why

Fleet's sandbox boot currently launches wardgate-proxy and immediately moves on to start OpenCode with sealed env vars. If the proxy never binds — or binds and then crashes on its first request — OpenCode's first sealed call goes to a dead socket and the failure surfaces in confusing ways. With this endpoint, the boot can do:

await proc.waitForPort(80, { mode: "http", path: "/health" });

so wardgate-proxy readiness is a hard precondition for downstream steps. Same pattern recommended in Fleet's pre-pentest audit F-06 fix-up (startup self-test that confirms the proxy is on path).

Tests

• TestHealthHandler_ReturnsOK — 200 + application/json + payload shape.
• TestHealthHandler_HEADReturnsNoBody — HEAD returns 200, empty body.
• TestHealthHandler_RejectsNonGET — POST returns 405 with Allow: GET, HEAD.
• TestBuildMux_HealthBypassesProxy — /health is served locally and never hits the upstream.
• TestBuildMux_NonHealthGoesToProxy — every other path still flows through the reverse-proxy with the agent's JWT injected.

Test plan

• go test ./cmd/wardgate-proxy/... -count=1 passes locally
• Existing proxy handler tests still pass (no behavior change for non-/health traffic)
• Reviewer: confirm /health is acceptable as a reserved path (no real upstream that wardgate fronts uses /health as a meaningful route in our deployments)

🤖 Generated with Claude Code