feat: add /api/quotas/health dependency probe

[emteebug12-jpg]

Summary

Adds GET /api/quotas/health, a health probe reporting the status of the external dependencies the /api/quotas route group relies on.

Today that's the shared PostgreSQL database, which backs quota-request persistence and the usage aggregation /api/quotas/counts depends on. The response shape ({ status, timestamp, dependencies }) and error-sanitization rules intentionally mirror the existing GET /api/health/dependencies probe, reusing its checkDatabase() / sanitizeCheck() helpers rather than duplicating that logic, so ops tooling can treat every dependency probe in the app the same way.

• src/routes/quotas/health.ts (new): the probe router. Applies the same correlationMiddleware and quotasDrainTracker already used by src/routes/quotas/counts.ts, so it gets X-Correlation-Id propagation and graceful-shutdown draining consistent with the rest of /api/quotas. Accepts an injectable pool for tests; defaults to the shared app pool otherwise. No auth required — same as the global dependencies probe, since it exposes no tenant data.
• src/routes/quotas.ts: mounts the new router at /api/quotas/health, after the shared per-user token-bucket rate limiter — the probe is protected by the same rate limit as every other /api/quotas endpoint, it isn't a bypass.
• docs/quotas-health-probe.md (new) + README.md: document the endpoint, response shape, HTTP status codes, and correlation-ID behavior, and cross-link it alongside the existing health-probe docs.
• src/routes/quotas/health.test.ts (new): 8 focused tests.

Closes #773

Test plan

• npx jest src/routes/quotas/health.test.ts — 8/8 passing:
  • 200/ok when the DB check succeeds; 503/down when it fails
  • error messages are sanitized (no connection string / stack leakage)
  • dependencies only ever contains database (no other dependency exists today)
  • correlation ID is echoed from x-correlation-id, or generated and returned in both the body and X-Correlation-Id header when absent
  • falls back correctly to the shared app pool when no pool is injected
  • drain-tracker middleware doesn't interfere with normal responses
• npx jest --coverage --collectCoverageFrom='src/routes/quotas/health.ts' src/routes/quotas/health.test.ts — 93.33% line coverage (only the outer catch-all error branch, which checkDatabase()'s own try/catch makes practically unreachable, is uncovered — same acknowledged limitation as the existing src/routes/health/dependencies.test.ts suite).
• npx jest src/routes/quotas — no new failures. One pre-existing failure in quotas.ratelimit.test.ts (injects retryAfterMs into the error envelope) reproduces identically on main without this branch's changes — unrelated to this PR.
• npx tsc --noEmit — no new type errors (2 pre-existing syntax errors on main, in src/controllers/authController.ts and src/routes/forecast.test.ts, reproduce identically without this branch).
• npx eslint src/routes/quotas.ts src/routes/quotas/health.ts src/routes/quotas/health.test.ts — clean.

[drips-wave]

@emteebug12-jpg Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

Solid — merged 🎉