fix: simplify public health to static response, add 403 test

Remove DB probe from public health endpoint - it only needs to confirm
the process is alive. Add test for non-admin user getting 403 on admin
health endpoint.

apps/api/src/index.ts

@@ -104,19 +104,10 @@ await teamsRoutes(app);
 await docsRoutes(app);
 
 // Public health check (minimal - no internal details)
-app.get("/api/v1/health", async () => {
+app.get("/api/v1/health", async () => ({
-  let dbOk = false;
+  status: "ok",
-  try {
-    db.select().from(schema.settings).limit(1).all();
-    dbOk = true;
-  } catch {
-    /* db unreachable */
-  }
-  return {
-    status: dbOk ? "healthy" : "degraded",
   version: APP_VERSION,
-  };
+}));
-});
 
 // Admin health check (full diagnostics)
 app.get("/api/v1/admin/health", async (request, reply) => {

tests/integration/api.test.ts

@@ -1164,7 +1164,7 @@ describe("Health & Config", () => {
       });
       expect(res.statusCode).toBe(200);
       const body = JSON.parse(res.body);
-      expect(body.status).toBe("healthy");
+      expect(body.status).toBe("ok");
       expect(body.version).toBeDefined();
       expect(body.uptime).toBeUndefined();
       expect(body.database).toBeUndefined();
@@ -1206,6 +1206,29 @@ describe("Health & Config", () => {
       });
       expect(res.statusCode).toBe(401);
     });
+
+    it("returns 403 for authenticated non-admin user", async () => {
+      // Create a regular user and log in as them
+      await app.inject({
+        method: "POST",
+        url: "/api/auth/register",
+        headers: { authorization: `Bearer ${adminToken}` },
+        payload: { username: "health_nonadmin", password: "Password1234", role: "user" },
+      });
+      const loginRes = await app.inject({
+        method: "POST",
+        url: "/api/auth/login",
+        payload: { username: "health_nonadmin", password: "Password1234" },
+      });
+      const userToken = JSON.parse(loginRes.body).token;
+
+      const res = await app.inject({
+        method: "GET",
+        url: "/api/v1/admin/health",
+        headers: { authorization: `Bearer ${userToken}` },
+      });
+      expect(res.statusCode).toBe(403);
+    });
   });
 
   describe("GET /api/v1/config/auth", () => {

tests/integration/test-server.ts

@@ -116,19 +116,10 @@ export async function buildTestApp(): Promise<TestApp> {
   await docsRoutes(app);
 
   // Public health check (minimal - no internal details)
-  app.get("/api/v1/health", async () => {
+  app.get("/api/v1/health", async () => ({
-    let dbOk = false;
+    status: "ok",
-    try {
-      db.select().from(schema.settings).limit(1).all();
-      dbOk = true;
-    } catch {
-      /* db unreachable */
-    }
-    return {
-      status: dbOk ? "healthy" : "degraded",
     version: APP_VERSION,
-    };
+  }));
-  });
 
   // Admin health check (full diagnostics)
   app.get("/api/v1/admin/health", async (request, reply) => {