Database-aware readiness, for monitoring only (no auth). It pings the primary database with a 2-second timeout and answers 200 when the ping succeeds, 503 when the database is unreachable. The result is cached for a few seconds per instance and at most one ping is in flight, so callers cannot load the database through it. It carries no detail about the failure. Cloud Run's probes keep using /health, which never touches the database, so a database blip never restarts an instance.