test(health): cover dependency failure paths and HTTP status mapping - #187

Closes #130

Summary

This PR adds/cleans integration coverage for /api/health dependency-failure behavior and verifies HTTP status mapping.

What Changed

• Refactored tests/integration/health.test.ts to remain integration-only (removed invalid pasted unit-test content).
• Added/validated scenarios:
  • DB failure -> 503 + status: down
  • Optional dependency (Soroban/Horizon) failure -> 200 + status: degraded
  • Multiple optional failures with healthy DB -> 200 + status: degraded
  • No-config fallback -> status: ok, service: callora-backend
  • Sensitive error details are not exposed in response body
  • Health check completes within expected timing threshold

Additional CI-unblock Fixes

• Resolved lint-blocking no-unsafe-declaration-merging issue in src/middleware/validate.ts.
• Fixed IP allowlist logging/type usage and empty-allowlist fallback behavior in src/middleware/ipAllowlist.ts (+ related test import update).

Verification

• npx prisma generate ✅
• npm run lint ✅ (0 errors, warnings remain)
• npx jest --runInBand tests/integration/health.test.ts src/services/healthCheck.test.ts ✅
  • Test Suites: 2 passed
  • Tests: 30 passed

CI Context

npm run typecheck is still failing on current upstream baseline files outside this ticket scope (for example src/config/env.ts, src/index.ts, src/events/event.emitter.test.ts, src/routes/billing.ts, etc.).
Health-check task coverage itself is implemented and validated via targeted test runs.

Security / Data Integrity Notes

• Health responses remain safe for public exposure (no secrets leaked).
• Added/kept assertion to ensure sensitive internal error text is not returned.
• Dependency checks remain timeout-bounded to keep checks fast.