Add unauthenticated /healthz endpoint

[neverlless]

Motivation

There is currently no way to health-check mokey without hitting authenticated pages: probing / (Kubernetes probes, blackbox_exporter, uptime monitors) redirects to login, logs Login required and no authenticated session found on every probe, and — because the CSRF middleware saves a session on every GET — creates a new session storage entry per probe.

Changes

• New GET /healthz endpoint returning 200 {"status":"ok"} when healthy, or 503 with the failing component when the session storage backend or FreeIPA is unreachable (uses storage.Get and the admin client's Ping()).
• Registered before the CSRF middleware, so probes don't create sessions and don't spam logs.

Testing

Running in production as Kubernetes startup/readiness probe and blackbox_exporter target:

$ curl -s -w ' -> %{http_code}
' http://localhost:8866/healthz
{"status":"ok"} -> 200

Log spam from probes is gone, and no per-probe sessions accumulate in redis anymore.