DC-012: Add Kubernetes-style /healthz + /readyz probe aliases

Fresh users copy-pasting healthcheck blocks from k8s/Docker docs need
the standard short aliases. Without /healthz and /readyz they get
connection refused. This commit:

1. Adds /healthz + /readyz as root-level aliases for /health/live +
   /health/ready in src/app.js. Handler bodies DRYed into named
   functions (livenessHandler, readinessHandler) so a probe semantics
   change updates all five paths at once.

2. Removes the dead /api/v1/health*, /api/v1/health/live, /api/v1/health/ready
   registrations from PUBLIC_ROUTES and CSRF exclusion list — those
   routes were never actually mounted on the apiRouter (only root
   paths existed). Anyone probing /api/v1/health now gets a clean 404
   instead of being routed through to a duplicate root handler.

3. Adds bypass for the 5 probe paths in three places where it matters:
   - PUBLIC_ROUTES (no auth)
   - csrf-protection.js excludedPaths (no CSRF check)
   - middleware.js request-logging exclusion (k8s polling every 10s
     doesn't flood the audit log)
   - middleware.js Tailscale auth bypass (probes don't carry Tailscale
     identity headers)

4. Adds __tests__/health-probe-aliases.test.js (19 tests):
   - Alias equivalence (/healthz == /health/live, /readyz == /health/ready)
   - Back-compat (/health == /health/live)
   - Path consolidation (all 3 /api/v1/health* return 404)
   - Source-of-truth PUBLIC_ROUTES allowlist sync check
   - Source-of-truth src/app.js mount list sync check (catches drift
     between handler mount and middleware allowlist)

5. Documents probes in README (copy-paste docker-compose.yml +
   Kubernetes blocks) and user-guide (Health Probes section + System
   API table updated).

Post-fix: 941/941 tests pass (+19 new). Zero new ESLint warnings
introduced. The pre-existing warnings/errors in src/app.js line 906
('os' is not defined) and the empty blocks in logging.test.js are
not regressions from this commit.

dashcaddy-api/__tests__/csrf-protection.test.js

@@ -169,7 +169,21 @@ describe('CSRF Protection', () => {
       const origEnv = process.env.NODE_ENV;
       process.env.NODE_ENV = 'production';
 
-      const excludedPaths = ['/api/v1/totp/verify', '/api/v1/totp/setup', '/health', '/api/v1/health'];
+      // Mirrors src/security/csrf-protection.js excludedPaths. If you add
+      // a new entry there, add it here too — the test guards against the
+      // drift that previously kept /api/v1/health in the list long after
+      // the route itself was deleted.
+      const excludedPaths = [
+        '/api/v1/totp/verify',
+        '/api/v1/totp/verify-setup',
+        '/api/v1/totp/setup',
+        '/health',
+        '/health/live',
+        '/health/ready',
+        '/healthz',
+        '/readyz',
+        '/api/v1/system/update-notify',
+      ];
       for (const excludedPath of excludedPaths) {
         const { req, res, next } = createMockReqRes({ method: 'POST', path: excludedPath });
         csrfValidationMiddleware(req, res, next);