feat: add estate-standard /health endpoint

[vreshch]

Summary

• Add @agentage/observability/health and mount GET /health at src/app/health/route.ts per the Next.js profile in specs/health-endpoints.md (export const dynamic = 'force-dynamic', no downstream dependency checks).
• service: 'diffractwd-web' passed explicitly - OTEL_SERVICE_NAME is not set anywhere in this repo's compose/env, so the kit default would have resolved to 'unknown'.
• Bump @agentage/observability from ^0.6.1 (already a dependency, used for @agentage/observability/next tracing register) to ^0.8.0 for the /health subpath.

Build provenance (Dockerfile)

Found: COMMIT_SHA / BRANCH / BUILD_TIME were declared as build-only ARGs in the builder stage, used solely to bake public/version.json (consumed by the pre-existing /api/version route). They never crossed into the runner stage, so any runtime reader (this new /health route) would have seen version: '0.0.0-dev' / commit: 'dev' / buildTime: null regardless of what was actually deployed.

Fix: redeclared ARG COMMIT_SHA="" BUILD_TIME="" in the runner stage and promoted both to ENV. Verified end to end - see below.

Compose healthcheck (judgement call)

Repointed the Swarm healthcheck from wget --spider http://127.0.0.1:3001/ to .../health. Justification: / renders the full marketing page (heavier, and a false-positive risk if a page-level error still 200s past the App Router shell), while /health is the purpose-built, cache-disabled probe the rest of the estate standardises on. Per the Next.js profile this route does no downstream dependency checks, so it can only ever fail if the process itself is unhealthy - which is exactly what a container healthcheck should assert. Verified wget --spider against the new path inside the built container (exit 0).

Test coverage

Repo has Vitest configured (src/**/*.test.{ts,tsx}), so added src/app/health/route.test.ts asserting 200 + data.service === 'diffractwd-web' + data.status === 'ok'.

Verification

• npm run verify (tsc --noEmit && next lint && next build && vitest run) - green, all 32 tests pass including the new one.

• npm run format:check - green (separate PR-validation CI step, not part of verify).

• docker build --build-arg COMMIT_SHA=testsha1234567890 --build-arg BUILD_TIME=2026-08-09T12:00:00Z . then ran the container and curled /health:

  {
    "success": true,
    "data": {
      "status": "ok",
      "service": "diffractwd-web",
      "version": "testsha1234567890",
      "commit": "testsha",
      "buildTime": "2026-08-09T12:00:00Z",
      "startedAt": "2026-08-09T14:35:06.727Z",
      "uptimeSeconds": 6
    }
  }

  commit is the short SHA, service matches the registry/telemetry name, provenance is read at runtime as required.

Test plan

• CI green on this PR (lint, format:check, build, docker build)
• After merge, confirm https://diffractwd.com/health returns the same envelope in prod

[github-actions]

🎉 PR Validation ✅ PASSED

Commit: 84cdfcaa7ece46c674033d8acf75e86362807715
Branch: feature/health-endpoint

Checks:

• ✅ Dependencies installed
• ✅ Linting passed
• ✅ Format check passed
• ✅ Build successful
• ✅ Docker build
• ✅ E2E tests

Visual Changes: 5 of 20 screenshots changed

📸 downloads dark desktop — 100% changed

📸 downloads dark mobile — 100% changed

📸 downloads light desktop — 100% changed

📸 downloads light mobile — 100% changed

📸 home dark mobile — 1.222% changed

Before	After	Diff

Ready to merge! ✨

---

🔗 View workflow run
⏰ Generated at: 2026-08-09T14:39:43.902Z