* fix: allow HEAD method for /health and /ready endpoints
Load balancers and uptime probes commonly issue HEAD requests against health endpoints. The /health and /ready handlers only matched GET, so HEAD fell through to the unhandled-request default (404). Extend both guards to accept HEAD and return headers-only (no body), preserving the status code (including /ready's 503-when-not-ready signal). Adds a regression test covering HEAD on both endpoints.
Closes #178
* test: assert HEAD preserves the 503 not-ready status on /ready
Covers the session-counting branch (non-stateless, no sessions -> 503), so the readiness signal is proven to survive a HEAD probe, not just /health's 200.
---------
Co-authored-by: Frank Fiegel <frank@glama.ai>