Fix /health/ready res.status bug + add comprehensive health endpoint tests

The readiness probe was crashing with 'res.status is not a function' because
asyncHandler(async (req, res) => {...}, 'health-ready') was called directly,
but asyncHandler's signature is (logError, fn, context) — first arg is the
logger, not the handler. The fix uses boundAsyncHandler like all other routes
in the file do.

Added 8 unit tests for both /health/live and /health/ready:
- live always 200 (liveness ≠ readiness)
- ready returns 503 when config/services/docker fail
- no 'res.status is not a function' crash when dependencies fail
- all 4 check keys present in response

Also added MONITORING_PUBLIC env var (defaults true) and the new health
endpoints to PUBLIC_ROUTES so k8s probes can hit them without auth.

dashcaddy-api/src/app.js

@@ -627,6 +627,86 @@ async function createApp() {
     res.json({ status: 'ok', timestamp: new Date().toISOString() });
   });
 
+  // Liveness probe — "is the process alive?"
+  // Always returns 200 unless the Node.js event loop is completely blocked.
+  // Used by k8s/Docker to decide whether to RESTART the container.
+  // DO NOT add dependency checks here — those belong in /health/ready.
+  app.get('/health/live', (req, res) => {
+    res.json({ status: 'alive', uptime: process.uptime() });
+  });
+
+  // Readiness probe — "is the app ready to serve traffic?"
+  // Checks critical dependencies: Docker daemon, Caddy admin API, config file.
+  // Returns 200 with details if all OK, 503 with failed components otherwise.
+  // Used by k8s/Docker to decide whether to ROUTE TRAFFIC to this instance.
+  app.get('/health/ready', boundAsyncHandler(async (req, res) => {
+    const checks = {};
+    let allOk = true;
+
+    // Check 1: Config file readable
+    try {
+      const fs = require('fs');
+      if (fs.existsSync(config.CONFIG_FILE)) {
+        fs.readFileSync(config.CONFIG_FILE, 'utf8');
+        checks.configFile = { ok: true };
+      } else {
+        checks.configFile = { ok: false, error: 'Config file not found' };
+        allOk = false;
+      }
+    } catch (e) {
+      checks.configFile = { ok: false, error: e.message };
+      allOk = false;
+    }
+
+    // Check 2: Services file readable
+    try {
+      const fs = require('fs');
+      if (fs.existsSync(config.SERVICES_FILE)) {
+        fs.readFileSync(config.SERVICES_FILE, 'utf8');
+        checks.servicesFile = { ok: true };
+      } else {
+        checks.servicesFile = { ok: false, error: 'Services file not found' };
+        allOk = false;
+      }
+    } catch (e) {
+      checks.servicesFile = { ok: false, error: e.message };
+      allOk = false;
+    }
+
+    // Check 3: Docker daemon reachable
+    try {
+      const docker = require('dockerode')();
+      await docker.ping();
+      checks.docker = { ok: true };
+    } catch (e) {
+      checks.docker = { ok: false, error: e.message };
+      allOk = false;
+    }
+
+    // Check 4: Caddy admin API reachable
+    try {
+      const caddyUrl = config.CADDY_ADMIN_URL || 'http://localhost:2019';
+      const controller = new AbortController();
+      const timeout = setTimeout(() => controller.abort(), 3000);
+      const response = await fetch(`${caddyUrl}/config/`, {
+        signal: controller.signal
+      });
+      clearTimeout(timeout);
+      checks.caddy = { ok: response.ok, status: response.status };
+      if (!response.ok) allOk = false;
+    } catch (e) {
+      checks.caddy = { ok: false, error: e.message };
+      allOk = false;
+    }
+
+    const body = {
+      status: allOk ? 'ready' : 'not-ready',
+      timestamp: new Date().toISOString(),
+      checks
+    };
+    res.status(allOk ? 200 : 503).json(body);
+  }));
+
   // Lightweight probe endpoint
   app.get('/probe/:id', boundAsyncHandler(async (req, res) => {
     const id = req.params.id;