ops: add public GET /api/health for status.profullstack.com (#345)

Returns {"status":"ok","db":"ok"} after a head-only PostgREST query with a
3s timeout, or 503 {"status":"error","db":"down"}. Cache-Control: no-store.
The proxy lets the path straight through, skipping the crawl gateway and
the session refresh.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: ralyodio

app/api/health/route.ts

@@ -0,0 +1,26 @@
+import { NextResponse } from "next/server";
+import { serviceClient } from "@/lib/supabase/service";
+
+export const runtime = "nodejs";
+// A cached answer reports the cache's health, not the app's.
+export const dynamic = "force-dynamic";
+
+const headers = { "cache-control": "no-store" };
+
+/**
+ * Public liveness + database check for status.profullstack.com. One head-only
+ * PostgREST count with a 3s cap; the reason for a failure is never returned.
+ */
+export async function GET() {
+  try {
+    const { error } = await serviceClient()
+      .from("projects")
+      .select("id", { head: true })
+      .limit(1)
+      .abortSignal(AbortSignal.timeout(3000));
+    if (error) throw error;
+  } catch {
+    return NextResponse.json({ status: "error", db: "down" }, { status: 503, headers });
+  }
+  return NextResponse.json({ status: "ok", db: "ok" }, { headers });
+}

proxy.ts

@@ -8,6 +8,8 @@ import { isNavigation } from "@/lib/affiliate/cookie";
 type Cookie = { name: string; value: string; options?: CookieOptions };
 
 export async function proxy(request: NextRequest) {
+  // The status page's health probe: no gateway, no session refresh.
+  if (request.nextUrl.pathname === "/api/health") return NextResponse.next();
   // Ad routes enforce their gate themselves, before DB work. Avoid counting a
   // request twice or making an unrelated Supabase Auth call for each click.
   if (isAdClickPath(request.nextUrl.pathname)) return NextResponse.next();