web: /healthz is answered only to local probes (audit I6)

Security audit 2026-10-17, finding I6 (low), stage 3. /healthz is
registered outside auth and every proxy fragment passed it through: the
live server answered "ok" to the internet, and "unhealthy: postfix"
would have been a free tell.

Now handleHealth answers only a request with no X-Forwarded-For (nor
Forwarded) from loopback or a private address: the image's HEALTHCHECK
(127.0.0.1), the host through the loopback-published port (the Docker
gateway), a monitor on the Docker network. Every supported proxy appends
X-Forwarded-For, so through it the endpoint is 404. The plan named
"trusted-proxy peers"; that would have let the internet in again through
the trusted proxy, hence this shape. The e2e's readiness probe is the
host's, and stays answered.

Test: TestHealthzAnswersOnlyLocalProbes. Docs: guide § Container health,
architecture.md; CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security-audit-2026-10-17.md

@@ -790,9 +790,12 @@ the argument.
 - [x] **A3.** After five unsolicited reset links in a day, one mail saying
   further requests are ignored for 24 h, then silence. — **Opus**, 1.5 h.
   *Done 2026-10-17:* TestResetLinksPauseForADayAfterFive.
-- [ ] **I6.** `/healthz` answered only to loopback and trusted-proxy peers;
+- [x] **I6.** `/healthz` answered only to loopback and trusted-proxy peers;
   the guide's "Container health" says the proxy may expose it on purpose
-  with the fragment line. — **Sonnet**, 0.5 h.
+  with the fragment line. — **Sonnet**, 0.5 h. *Done 2026-10-17,* in another
+  shape: answered to a request with no `X-Forwarded-For` from loopback or a
+  private address - a trusted proxy's peer would have let the internet in
+  again through that proxy; TestHealthzAnswersOnlyLocalProbes.
 
 ### Stage 4 — resources and imports (~5 h)