DC-032: fix health checker authLimiter feedback loop + ca.sami DNS

Three coordinated changes to stop every gated *.sami service flipping
red after ~20 probes:

1. health-checker.js _doRequest() now sends X-DashCaddy-HealthCheck: 1
   on every outgoing probe. Caddy uses this header (combined with a
   trusted source IP via the new @healthcheckProbe matcher in the
   dashcaddy_auth snippet) to bypass forward_auth for local container
   probes. Without the bypass, forward_auth 401's every probe, and the
   authLimiter (20 req / 15 min, DC-027) caps us out within minutes.

2. evaluateHealth() default expectedStatusCodes now includes 401, 403,
   and 429. Defense in depth — if a future Caddy reload drops the
   bypass, 429 from the rate-limited gate no longer marks the service
   as down (it just means the gate answered, which proves the service
   is reachable through Caddy).

3. (start.sh — already shipped on the running container, will land
   with the next release build) ca.sami now maps to 100.121.150.22
   (DNS2) instead of 127.0.0.1, which is the container's own loopback
   where nothing serves :443. The CA web UI lives on DNS2's Caddy.

Tests:
- evaluateHealth: 401, 403, 429 accepted by default
- _doRequest: X-DashCaddy-HealthCheck: 1 always present
- _doRequest: user-supplied headers preserved alongside marker

Bump 1.14.7 → 1.14.8.

dashcaddy-api/src/monitoring/health-checker.js

@@ -178,13 +178,26 @@ class HealthChecker extends EventEmitter {
       const url = new URL(config.url);
       const protocol = url.protocol === 'https:' ? https : http;
 
+      // Merge user-supplied headers with the health-check marker. Caddy on
+      // *.sami uses `forward_auth` for every non-API path and the auth gate
+      // returns 401 for HEAD/GET without a session — without this marker the
+      // probe never reaches the upstream service, and the authLimiter (20 req
+      // / 15 min) on /auth/* would also rate-limit us after 20 probes. The
+      // marker lets the Caddy snippet bypass forward_auth for probes that
+      // originate from the local container network (see /etc/caddy/Caddyfile
+      // `(dashcaddy_auth)` block).
+      const headers = {
+        ...(config.headers || {}),
+        'X-DashCaddy-HealthCheck': '1'
+      };
+
       const options = {
         hostname: url.hostname,
         port: url.port || (url.protocol === 'https:' ? 443 : 80),
         path: url.pathname + url.search,
         method,
         timeout: config.timeout || 20000,
-        headers: config.headers || {},
+        headers,
         rejectUnauthorized: false // Trust internal CA certs (.sami TLD)
       };
 
@@ -231,8 +244,11 @@ class HealthChecker extends EventEmitter {
    * Evaluate if service is healthy based on response
    */
   evaluateHealth(statusCode, body, config) {
-    // Check status code
-    const expectedCodes = config.expectedStatusCodes || [200, 201, 204, 301, 302, 303, 307, 308];
+    // Check status code. Default expected codes include the usual 2xx/3xx
+    // plus 401/403 (auth-walled UIs that still prove the service is up) and
+    // 429 (rate-limited upstream — we hit the service, the service answered;
+    // failing the check just because we're being throttled is wrong).
+    const expectedCodes = config.expectedStatusCodes || [200, 201, 204, 301, 302, 303, 307, 308, 401, 403, 429];
     if (!expectedCodes.includes(statusCode)) {
       return false;
     }