feat(health): /api/health/services (grouped+counts) + owner /check

Adds GET /api/health/services returning registry services grouped by
category with merged cached status and per-group healthy counts, and
POST /api/health/check (owner-only) that enqueues a health.check
pg-boss job. Registers the health_check worker in the jobs index.

tests/api/health.test.js

@@ -0,0 +1,22 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import request from 'supertest';
+import { setup } from './helpers.js';
+import * as statusRepo from '../../lib/db/repos/service_status.js';
+
+let app, ownerHeaders;
+beforeAll(async () => {
+  ({ app, ownerHeaders } = await setup());
+  await statusRepo.upsert({ service_id: 'gitea', status: 'ok', latency_ms: 10, detail: '200' });
+});
+describe('health api', () => {
+  it('401 without auth', async () => expect((await request(app).get('/api/health/services')).status).toBe(401));
+  it('returns groups with counts + merged cached status', async () => {
+    const res = await request(app).get('/api/health/services').set(ownerHeaders);
+    expect(res.status).toBe(200);
+    const infra = res.body.find(g => g.category === 'infrastructure');
+    expect(infra).toBeTruthy();
+    expect(infra.healthy).toBeGreaterThanOrEqual(1);   // gitea ok
+    const gitea = infra.services.find(s => s.id === 'gitea');
+    expect(gitea.status).toBe('ok');
+  });
+});