Add /healthz endpoint via mcdsl/health

Database ping health check at /healthz, no auth required. Seal state
is still reported via the existing /v1/status endpoint.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/server/server.go

@@ -3,6 +3,7 @@ package server
 
 import (
 	"context"
+	"database/sql"
 	"log/slog"
 	"sync"
 
@@ -21,6 +22,7 @@ import (
 // Server is the Metacrypt HTTP server.
 type Server struct {
 	cfg          *config.Config
+	database     *sql.DB
 	seal         *seal.Manager
 	auth         *auth.Authenticator
 	policy       *policy.Engine
@@ -35,10 +37,11 @@ type Server struct {
 }
 
 // New creates a new server.
-func New(cfg *config.Config, sealMgr *seal.Manager, authenticator *auth.Authenticator,
+func New(cfg *config.Config, database *sql.DB, sealMgr *seal.Manager, authenticator *auth.Authenticator,
 	policyEngine *policy.Engine, engineRegistry *engine.Registry, auditLog *audit.Logger, logger *slog.Logger, version string) *Server {
 	s := &Server{
-		cfg:     cfg,
+		cfg:      cfg,
+		database: database,
 		seal:    sealMgr,
 		auth:    authenticator,
 		policy:  policyEngine,