fix: improve unpaid service health coverage - #1051

Summary

Make unpaid service-health audits work behind configured HTTP proxies and system certificate authorities, instead of reporting network timeouts for reachable services.

• Add 12 explicitly safe POST fixtures for Firecrawl search, Diffbot text analysis, Tavily search, and nine Abstract lookup services. Payment, purchase, messaging, resource-creation, and other unsafe routes remain excluded.
• Include per-service endpoint counts in the JSON artifact and show attempted/passing endpoint coverage in the Markdown report. Reachable links do not count as verified endpoints; services with no attempted endpoints are listed explicitly as coverage gaps.

Live audit

The live directory contained 137 services across its nine categories, matching the local service IDs and service URLs. An unpaid run on October 5, 2026 produced 1,834 findings:

• 631 passed, 11 failed, 192 inconclusive, and 1,000 skipped, including link checks.
• 362 endpoint probes were attempted across 88 services: 169 passed, 11 returned 404, and 182 were inconclusive.
• The 404 routes belong to nine Abstract services and AgentMail (/v0/api-keys and /v0/organizations). These are route findings, not evidence that entire providers are down.
• 49 services have no attempted endpoint probes. These gaps remain visible; no payments or fulfillment tests were performed.

Validation

• pnpm test: 44 files / 9,702 tests passed.
• pnpm check:types: passed.
• pnpm check:ci: passed.
• pnpm check:services: completed against the live services with the results above.
• pnpm build: passed.

Directory follow-up

Additional unpaid rechecks on October 5, 2026 returned 404 with Unknown endpoint for every advertised route (15 routes total) across these ten Locus-backed listings:

• abstract-company-enrichment
• abstract-email-reputation
• abstract-exchange-rates
• abstract-holidays
• abstract-iban-validation
• abstract-ip-intelligence
• abstract-phone-intelligence
• abstract-timezone
• abstract-vat
• abstract-web-scraping

These namespaces are also absent from Locus's supported MPP provider list. Recommend temporarily delisting these entries pending a working replacement endpoint or provider confirmation. This PR does not remove directory entries.

Keep AgentMail: /v0/inboxes still returns a valid matching MPP Challenge. /v0/api-keys and /v0/organizations return 404 with an endpoint-not-registered error; those two route listings need cleanup, not removal of the service.

Prompted by: @brendanjryan