Liveness for the compose healthcheck: 200 only when startup launched the background loops AND every one of them is still running. task.done() catches death (exception or return), not hangs; a per-loop heartbeat registry is the documented next step if hung-but-alive ever bites. Exposes loop NAMES only, no user data.

Replaces the older /healthz that counted active users via a DB query: that answered 200 with every loop dead (process-up-only, the audit finding), loaded every active user row per hit, and published the active-user count on an unauthenticated route. GET+HEAD and the "ok" key are kept for whatever external monitor may already poll this.