feat(health): /api/health/services (grouped+counts) + owner /check

Adds GET /api/health/services returning registry services grouped by
category with merged cached status and per-group healthy counts, and
POST /api/health/check (owner-only) that enqueues a health.check
pg-boss job. Registers the health_check worker in the jobs index.

lib/api/routes/health.js

@@ -0,0 +1,30 @@
+import { Router } from 'express';
+import { asyncWrap } from '../errors.js';
+import { requireOwner } from '../cap.js';
+import { load, grouped, iconSlug } from '../../health/registry.js';
+import * as statusRepo from '../../db/repos/service_status.js';
+import { enqueue } from '../../jobs/queue.js';
+
+export const router = Router();
+
+router.get('/services', asyncWrap(async (_req, res) => {
+  const statuses = Object.fromEntries((await statusRepo.all()).map(s => [s.service_id, s]));
+  const groups = grouped(load()).map(g => {
+    const services = g.services.map(s => {
+      const st = statuses[s.id];
+      return {
+        id: s.id, name: s.name, host: s.host, url: s.url, icon: iconSlug(s),
+        status: st?.status || 'unknown', latency_ms: st?.latency_ms ?? null,
+        detail: st?.detail || null, checked_at: st?.checked_at || null
+      };
+    });
+    return { category: g.category, healthy: services.filter(s => s.status === 'ok').length,
+      total: services.length, services };
+  });
+  res.json(groups);
+}));
+
+router.post('/check', requireOwner, asyncWrap(async (_req, res) => {
+  const id = await enqueue('health.check', {});
+  res.status(202).json({ enqueued: id });
+}));