Add a frontend health route for container probes

[akwasigroch]

Purpose

The frontend's liveness and readiness probes point at /, the app's root page. Every probe renders the real page — data fetching, auth, log lines — and readiness runs every 10 seconds. That's the frontend half of the same noise #2565 fixed on the backend.

What Changed

• Add apps/frontend/src/app/api/health/route.ts — returns {"status":"ok"} and nothing else. Marked dynamic = 'force-static', so no auth, no backend call, no data fetching.
• Point the k8s livenessProbe and readinessProbe in charts/rhesis/templates/frontend/deployment.yaml at /api/health instead of /.
• Point the HEALTHCHECK in apps/frontend/Dockerfile at /api/health instead of /.
• Point the frontend service healthcheck in docker-compose.yml at /api/health. It was hitting /api/auth/session, which pulled in the whole auth stack on every poll.
• Add a route-handler test following the existing architect-help pattern.

No middleware change was needed: the matcher in apps/frontend/src/proxy.ts already excludes api, so /api/health never reaches the auth check.

Additional Context

• Backend counterpart: Fix noisy health-probe access logs in backend #2565.
• The frontend chart template hardcodes its probe paths, unlike the backend/worker/polyphemus templates which read them from values. Left as is — making the chart consistent is a separate change.
• playwright.config.ts still waits on / for dev-server readiness. That's a one-shot startup wait, not a repeating probe, so it's untouched.
• Noticed in passing: PUBLIC_PATHS in apps/frontend/src/constants/paths.ts has a stale /api/warmup entry for a route that no longer exists. Not touched here.

Testing

cd apps/frontend
npx jest src/app/api/health   # 1 passed
npx tsc --noEmit              # clean
npx eslint src/app/api/health --ext .ts

Rendered probe paths:

helm template rhesis charts/rhesis --show-only templates/frontend/deployment.yaml \
  --set existingSecret=dummy --set externalDatabase.host=x --set externalAnalyticsDatabase.host=x

Both probes render as path: /api/health on port 3000.

Manually: start the frontend and curl -i localhost:3000/api/health → 200 with {"status":"ok"}, and no page-render log line.

[peqy]

Looks good. The dedicated /api/health route keeps probes from rendering the root page / hitting auth, and the probe targets are updated consistently across k8s, Dockerfile, and docker-compose. Ship it.