fix: move health diagnostics behind admin auth

Public GET /api/v1/health now returns only status and version.
Full diagnostics (uptime, storage, database, queue) moved to
GET /api/v1/admin/health which requires admin authentication.

apps/api/src/index.ts

@@ -6,7 +6,7 @@ import { env } from "./config.js";
 import { db, schema } from "./db/index.js";
 import { runMigrations } from "./db/migrate.js";
 import { startCleanupCron } from "./lib/cleanup.js";
-import { authMiddleware, authRoutes, ensureDefaultAdmin } from "./plugins/auth.js";
+import { authMiddleware, authRoutes, ensureDefaultAdmin, requireAdmin } from "./plugins/auth.js";
 import { registerStatic } from "./plugins/static.js";
 import { registerUpload } from "./plugins/upload.js";
 import { apiKeyRoutes } from "./routes/api-keys.js";
@@ -103,8 +103,26 @@ await teamsRoutes(app);
 // API docs (Scalar)
 await docsRoutes(app);
 
-// Health check
+// Public health check (minimal - no internal details)
 app.get("/api/v1/health", async () => {
+  let dbOk = false;
+  try {
+    db.select().from(schema.settings).limit(1).all();
+    dbOk = true;
+  } catch {
+    /* db unreachable */
+  }
+  return {
+    status: dbOk ? "healthy" : "degraded",
+    version: APP_VERSION,
+  };
+});
+
+// Admin health check (full diagnostics)
+app.get("/api/v1/admin/health", async (request, reply) => {
+  const admin = requireAdmin(request, reply);
+  if (!admin) return;
+
   let dbOk = false;
   try {
     db.select().from(schema.settings).limit(1).all();

tests/integration/api.test.ts

@@ -1157,7 +1157,7 @@ describe("Tool processing", () => {
 // ═══════════════════════════════════════════════════════════════════════════
 describe("Health & Config", () => {
   describe("GET /api/v1/health", () => {
-    it("returns healthy status without auth", async () => {
+    it("returns only status and version without auth", async () => {
       const res = await app.inject({
         method: "GET",
         url: "/api/v1/health",
@@ -1166,7 +1166,10 @@ describe("Health & Config", () => {
       const body = JSON.parse(res.body);
       expect(body.status).toBe("healthy");
       expect(body.version).toBeDefined();
-      expect(body.uptime).toBeDefined();
+      expect(body.uptime).toBeUndefined();
+      expect(body.database).toBeUndefined();
+      expect(body.storage).toBeUndefined();
+      expect(body.queue).toBeUndefined();
     });
 
     it("also works with auth", async () => {
@@ -1179,6 +1182,32 @@ describe("Health & Config", () => {
     });
   });
 
+  describe("GET /api/v1/admin/health", () => {
+    it("returns full diagnostics for admin", async () => {
+      const res = await app.inject({
+        method: "GET",
+        url: "/api/v1/admin/health",
+        headers: { authorization: `Bearer ${adminToken}` },
+      });
+      expect(res.statusCode).toBe(200);
+      const body = JSON.parse(res.body);
+      expect(body.status).toBe("healthy");
+      expect(body.version).toBeDefined();
+      expect(body.uptime).toBeDefined();
+      expect(body.database).toBe("ok");
+      expect(body.storage).toBeDefined();
+      expect(body.queue).toBeDefined();
+    });
+
+    it("rejects unauthenticated requests", async () => {
+      const res = await app.inject({
+        method: "GET",
+        url: "/api/v1/admin/health",
+      });
+      expect(res.statusCode).toBe(401);
+    });
+  });
+
   describe("GET /api/v1/config/auth", () => {
     it("returns authEnabled flag without auth", async () => {
       const res = await app.inject({

tests/integration/test-server.ts

@@ -29,7 +29,12 @@ import Fastify from "fastify";
 import { env } from "../../apps/api/src/config.js";
 import { db, schema } from "../../apps/api/src/db/index.js";
 import { runMigrations } from "../../apps/api/src/db/migrate.js";
-import { authMiddleware, authRoutes, ensureDefaultAdmin } from "../../apps/api/src/plugins/auth.js";
+import {
+  authMiddleware,
+  authRoutes,
+  ensureDefaultAdmin,
+  requireAdmin,
+} from "../../apps/api/src/plugins/auth.js";
 import { registerUpload } from "../../apps/api/src/plugins/upload.js";
 import { apiKeyRoutes } from "../../apps/api/src/routes/api-keys.js";
 import { registerBatchRoutes } from "../../apps/api/src/routes/batch.js";
@@ -110,15 +115,43 @@ export async function buildTestApp(): Promise<TestApp> {
   // API docs (Scalar)
   await docsRoutes(app);
 
-  // Health check
-  app.get("/api/v1/health", async () => ({
-    status: "healthy",
-    version: APP_VERSION,
-    uptime: process.uptime().toFixed(0) + "s",
-    storage: { mode: env.STORAGE_MODE, available: "N/A" },
-    queue: { active: 0, pending: 0 },
-    ai: {},
-  }));
+  // Public health check (minimal - no internal details)
+  app.get("/api/v1/health", async () => {
+    let dbOk = false;
+    try {
+      db.select().from(schema.settings).limit(1).all();
+      dbOk = true;
+    } catch {
+      /* db unreachable */
+    }
+    return {
+      status: dbOk ? "healthy" : "degraded",
+      version: APP_VERSION,
+    };
+  });
+
+  // Admin health check (full diagnostics)
+  app.get("/api/v1/admin/health", async (request, reply) => {
+    const admin = requireAdmin(request, reply);
+    if (!admin) return;
+
+    let dbOk = false;
+    try {
+      db.select().from(schema.settings).limit(1).all();
+      dbOk = true;
+    } catch {
+      /* db unreachable */
+    }
+    return {
+      status: dbOk ? "healthy" : "degraded",
+      version: APP_VERSION,
+      uptime: `${process.uptime().toFixed(0)}s`,
+      storage: { mode: env.STORAGE_MODE, available: "N/A" },
+      database: dbOk ? "ok" : "error",
+      queue: { active: 0, pending: 0 },
+      ai: {},
+    };
+  });
 
   // Public config endpoint
   app.get("/api/v1/config/auth", async () => ({