fix: add lightweight /healthz endpoint, skip SSR for k8s probes

Add /healthz handler in hooks.server.ts that returns early without auth
or SSR processing. Update Helm probes from / to /healthz to avoid
unnecessary log noise and wasted SSR renders.

web/deploy/helm/templates/deployment.yaml

@@ -46,14 +46,14 @@ spec:
               mountPath: /tmp
           livenessProbe:
             httpGet:
-              path: /
+              path: /healthz
               port: http
             initialDelaySeconds: 5
             periodSeconds: 10
             timeoutSeconds: 3
           readinessProbe:
             httpGet:
-              path: /
+              path: /healthz
               port: http
             initialDelaySeconds: 3
             periodSeconds: 10

web/src/hooks.server.ts

@@ -4,6 +4,11 @@ import { refreshTokens } from '$lib/api/client.server.js';
 import type { ProfileData } from '$lib/api/types.js';
 
 export const handle: Handle = async ({ event, resolve }) => {
+	// Lightweight health endpoint for k8s probes — bypass auth and SSR.
+	if (event.url.pathname === '/healthz') {
+		return new Response('ok', { status: 200 });
+	}
+
 	const accessToken = event.cookies.get('access_token');
 	const sessionToken = event.cookies.get('session_token');