Add /healthz endpoint via mcdsl/health

Database ping health check at /healthz, no auth required. Seal state
is still reported via the existing /v1/status endpoint.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/server/server_test.go

@@ -65,7 +65,7 @@ func setupTestServer(t *testing.T) (*Server, *seal.Manager, chi.Router) {
 	}
 
 	logger := slog.Default()
-	srv := New(cfg, sealMgr, authenticator, policyEngine, engineRegistry, nil, logger, "test")
+	srv := New(cfg, database, sealMgr, authenticator, policyEngine, engineRegistry, nil, logger, "test")
 
 	r := chi.NewRouter()
 	srv.registerRoutes(r)