fix: healthchecks

[pozgo]

Fix Docker Healthcheck with Authentication & TLS

Closes #15

Fixed

• Docker healthcheck fails when authentication is enabled - The /api/health endpoint was behind the authentication middleware, causing Docker health probes to receive 401 Unauthorized when AUTH_ENABLED=true. The health endpoint is now exempt from authentication, following industry best practices for container orchestration.
• Docker healthcheck fails when TLS is enabled - The healthcheck command was hardcoded to http://, causing TLS handshake errors when HTTPS was configured. A new healthcheck.sh script auto-detects TLS configuration from environment variables and uses the correct scheme.

Changed

Backend

• Added ExcludePaths support to the authentication middleware (internal/middleware/auth.go) - allows specific paths to bypass authentication
• Registered /api/health as an excluded path in route setup (internal/server/server.go)
• Added Swagger annotations for the health endpoint (was previously undocumented in Swagger UI)

Docker

• New scripts/healthcheck.sh - TLS-aware healthcheck script that reads WEBCLI_TLS_CERT_PATH / TLS_CERT_PATH environment variables to determine http vs https scheme
• Updated Dockerfile to copy and use healthcheck.sh instead of inline curl command
• Updated docker-compose.yml to use /app/healthcheck.sh for health checks

Documentation

• Updated API.md - health endpoint now documented as not requiring authentication
• Updated docs/SECURITY.md - added "Unauthenticated Endpoints" section listing exempt paths
• Regenerated Swagger spec (docs/swagger.json, docs/swagger.yaml) with health endpoint

Testing

• 6 new tests added covering the fix:
  • TestBasicAuth_ExcludedPaths - verifies excluded paths bypass auth
  • TestBasicAuth_ExcludedPathsEmpty - verifies nil exclusions still require auth
  • TestBasicAuth_ExcludedPathsMultiple - verifies multiple paths can be excluded
  • TestHandleHealth - basic health handler response test
  • TestHandleHealth_NoAuthRequired - full routing integration test with auth middleware
• All existing tests continue to pass
• Docker end-to-end tested: container reports healthy with AUTH_ENABLED=true
• Race detector clean (go test -race ./...)
• Shellcheck clean on healthcheck.sh

Security Notes

• Only the /api/health endpoint is exempt from authentication
• The health endpoint returns only {"status":"ok"} - no sensitive information is exposed
• All other API endpoints continue to require authentication when AUTH_ENABLED=true
• The ExcludePaths mechanism uses exact path matching (no wildcards) to prevent accidental bypasses