fix: simplify public health to static response, add 403 test

Remove DB probe from public health endpoint - it only needs to confirm
the process is alive. Add test for non-admin user getting 403 on admin
health endpoint.

apps/api/src/index.ts

@@ -104,19 +104,10 @@ await teamsRoutes(app);
 await docsRoutes(app);
 
 // Public health check (minimal - no internal details)
-app.get("/api/v1/health", async () => {
-  let dbOk = false;
-  try {
-    db.select().from(schema.settings).limit(1).all();
-    dbOk = true;
-  } catch {
-    /* db unreachable */
-  }
-  return {
-    status: dbOk ? "healthy" : "degraded",
-    version: APP_VERSION,
-  };
-});
+app.get("/api/v1/health", async () => ({
+  status: "ok",
+  version: APP_VERSION,
+}));
 
 // Admin health check (full diagnostics)
 app.get("/api/v1/admin/health", async (request, reply) => {