Instance liveness probe

Exercises the two paths that have wedged a single instance while the process itself stayed healthy: outbound signing egress, and the Postgres connection pool. Returns 503 when either is unusable from this instance, so a Cloud Run liveness probe recycles it. Deliberately kept off the startup probe so replacements still boot during a genuine upstream outage.