[grade=A] DC-075: System health endpoint + DC-069 notification cooldown verified

GET /api/v1/system/health — unauthenticated endpoint for UptimeRobot/BetterStack.
Returns: { status, timestamp, checks: { services, memory, diskSpace, uptime, incidents } }
- Services: counts healthy/unhealthy/unknown explicitly
- Memory: used/total/free with 10% free threshold
- Disk space: df on data dir, 90%/95% thresholds
- Overall: unknown→degraded, critical→unhealthy

DC-069: notification manager already uses state-transition pattern (only fires
on wasDown→isDown change), incidents deduplicate via occurrences++. Already handled.

Codex: C→A iteration. 3 issues fixed (PUBLIC_ROUTES, unknown counting, disk check).

dashcaddy-api/src/utilities/middleware.js

@@ -437,6 +437,8 @@ module.exports = function configureMiddleware(app, {
     { path: '/api/v1/config',             exact: true,  method: 'GET' },
     { path: '/api/v1/services/status',    exact: true,  method: 'GET' },
     { path: '/api/v1/health-checks/status', exact: true, method: 'GET' },
+    // DC-075: System health endpoint for external uptime monitoring (UptimeRobot, BetterStack)
+    { path: '/api/v1/system/health',   exact: true,  method: 'GET' },
     // System Overview widget on the dashboard — needs the flattened CPU/mem
     // data without going through auth. See skill references/totp-and-system-overview-pitfalls.md §3.
     { path: '/api/v1/monitoring/stats',      exact: true, method: 'GET' },