Confirm the bearer token is valid and say who it belongs to.

200 with the caller's identity, or 401. Accepts read OR emit tokens (same gate as the data routes a caller is proving access for), and rejects admin/registration — so nothing is tempted to use an admin credential for a routine liveness check.

Resolution is tenant-local first (by Host). On a 401 miss, a UNIFIED ge_tok_ is resolved ACROSS tenants (see _resolve_cross_tenant_unified) so the fleet router — which probes the default collector base first — learns the token's owning tenant from that one probe, with no per-tenant routes.json entry. The x-polaris-tenant response header (set by the tenant middleware from request.state.tenant_id, which the fallback overrides) names that owner.