Add /healthz endpoint via mcdsl/health

Database ping health check at /healthz, no auth required. Seal state
is still reported via the existing /v1/status endpoint.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/server/routes.go

@@ -11,6 +11,7 @@ import (
 
 
 
+	"git.wntrmute.dev/kyle/mcdsl/health"
 	"git.wntrmute.dev/kyle/metacrypt/internal/audit"
 	"git.wntrmute.dev/kyle/metacrypt/internal/auth"
 	"git.wntrmute.dev/kyle/metacrypt/internal/barrier"
@@ -23,6 +24,9 @@ import (
 )
 
 func (s *Server) registerRoutes(r chi.Router) {
+	// Health check (database ping, no auth required).
+	r.Get("/healthz", health.Handler(s.database))
+
 	// REST API routes — web UI served by metacrypt-web.
 	r.Get("/v1/status", s.handleStatus)
 	r.Post("/v1/init", s.handleInit)