Health Auth Config

Diagnostic probe for the auth pipeline.

Returns:

• whether SUPABASE_JWT_SECRET / SUPABASE_URL / SUPABASE_ANON_KEY / INTERNAL_API_KEY are populated (just the presence bit, never the value) so we can tell from outside whether the Hetzner env file has the keys our auth middleware depends on;
• what JWTAuthMiddleware decided about the current request — user_id (if populated, the first 8 chars as a sanity check) and auth_error (the failure reason string if any).

No secrets in the response. Exempt from InternalAuthMiddleware via the /health prefix allowlist so mobile/curl can reach it without an internal key.