Add /health endpoint distinguishing setup_required from ready #47

Summary

Currently there is no way to distinguish "server process is up and port is listening" from "server is actually usable" (past first-run setup, provider configured). A process supervisor (systemd, Docker healthcheck, a load balancer if ever relevant) needs a clear signal for this — right now the only observable behavior is that API calls return 401/errors until setup is manually completed, which is not a real readiness signal.

Fix

Add GET /api/health (unauthenticated — this must be reachable without an API key or session, since its whole purpose is pre-setup diagnostics):

// Before first-run setup completed
{ "status": "setup_required" }

// After setup, provider configured, ready to serve requests
{ "status": "ready" }

Consider a third state if useful: "status": "degraded" for cases where the server is up and setup is complete, but something non-fatal is wrong (e.g. provider unreachable at last check) — optional, don't over-engineer this if it adds complexity disproportionate to the value; setup_required vs ready covers the reported pain point on its own.

Acceptance criteria

• GET /api/health reachable with zero auth, works even on a completely fresh unconfigured instance.
• Returns setup_required before the admin account / provider config exists.
• Returns ready once both are in place.
• Document this endpoint in the README as the recommended healthcheck target for Docker/systemd, with an example Docker HEALTHCHECK or systemd ExecStartPost snippet.