sec(api): strip /healthz filename + drop env-var names from public 401s (API-21/90/217)

[mastermanas805]

Summary

Two recon-leak fixes on public anon-reachable surfaces.

BUG-API-090 / BUG-API-217 — /healthz migration_version filename leak

Before:

$ curl https://api.instanode.dev/healthz | jq .migration_version
"063_forwarder_sent_audit_link.sql"

That literally tells an attacker which feature shipped at which migration number. An anon-reachable probe must not provide that recon. Add migrations.State.PublicVersion() that strips to the numeric prefix only ("063"). Canaries keep the commit_id + migration_count + migration_version drift tuple; attackers learn nothing about the schema.

BUG-API-021 (+ siblings) — webhook 401 envelope literally named env vars

Before:
```json
"agent_action": "...Operators must verify the Brevo dashboard webhook URL matches the configured BREVO_WEBHOOK_SECRET..."
```
The public 401 returned by `/webhooks/brevo/` — reachable by any brute-forcer — named the exact env-var key. Soften 3 agent_action sentences (`brevo_secret_mismatch`, `webhook_secret_mismatch`, `webhook_signature_mismatch`). Point at the docs page where operator-side rotation lives.

What did NOT change

• Wire shape: error codes, statuses, messages all preserved
• No new endpoints, no new fields, no auth changes
• migration_count + migration_status unchanged

Surface checklist (rule 22)

• ✅ `api/internal/migrations/state.go` — `PublicVersion()` helper
• ✅ `api/internal/router/router.go` — `/healthz` emits `PublicVersion()`
• ✅ `api/internal/router/healthz_test.go` — pinned-shape test updated + new regression
• ✅ `api/internal/handlers/helpers.go` — 3 agent_action sentences softened
• ✅ `api/internal/handlers/brevo_webhook_test.go` — assertion BREVO_* env names never reach wire
• ✅ OpenAPI / dashboard / marketing — no surface change (envelope shape unchanged, schema lines update text only)

Coverage block

```
Symptom: /healthz.migration_version "063_forwarder_sent_audit_link.sql";
brevo 401 agent_action names BREVO_WEBHOOK_SECRET
Enumeration: rg -F 'BREVO_WEBHOOK_SECRET' internal/handlers/helpers.go
rg -F 'mstate.Filename' internal/router/
Sites found: 3 agent_action strings + 1 router emit
Sites touched: 4 / 4
Coverage test: TestHealthzMigrationVersionStripsFilenameSuffix (asserts no '' or '.sql'
in output across 7 cases — would fail if a future refactor reverts to
emitting filename); brevo_webhook_test asserts no BREVO* in body.
Live verified: pre-merge above (curl evidence shown)
```

Local gate

• `go build ./...` ✅
• `go vet ./...` ✅
• `go test ./internal/migrations/` ✅
• `go test ./internal/router/` ✅
• `go test -run 'Brevo' ./internal/handlers/` ✅

Live verify plan (post-merge)

```bash
curl https://api.instanode.dev/healthz | jq .commit_id # must match merge SHA
curl https://api.instanode.dev/healthz | jq .migration_version # must be "063"
curl https://api.instanode.dev/webhooks/brevo/x -X POST | jq .agent_action # must NOT contain BREVO_
```

🤖 Generated with Claude Code