feat: add GET /api/recommendations/health probe endpoint

[mrteeednut007-dotcom]

feat: add GET /api/recommendations/health probe endpoint

Summary

Implements a focused health probe for the /api/recommendations subsystem that reports the live
status of its two external runtime dependencies. Resolves the GrantFox FWC26 campaign issue.

What changed

• src/routes/recommendations/health.ts — New route file. Exposes GET /health via a factory
  function (createRecommendationsHealthRouter) with injectable probe callbacks so tests never
  touch real infrastructure. Runs database and sorobanRpc probes in parallel, returns 200 when
  both pass and 503 when either fails. Echoes X-Correlation-Id header or generates a UUID
  fallback. Emits structured pino log on every request.
• src/index.ts — Imports and mounts recommendationsHealthRouter at /api/recommendations/health,
  placed before the general recommendations router to prevent route shadowing.
• tests/recommendationsHealth.test.ts — 28 focused unit tests covering HTTP status codes,
  response shape, per-dependency latency/error fields, correlation ID echo and fallback, auth
  access control (no auth required), error propagation (probe throws → 500), probe call counts,
  and default export validation.
• docs/recommendations-health.md — Runbook covering request/response shape, probe methods, HTTP
  codes, structured log events, and security guidance.
• README.md — Added endpoint row to the Health Endpoints table.

Response shape

{
"status": "ok",
"correlationId": "3a6d1f2c-...",
"checkedAt": "2026-07-28T19:27:42.000Z",
"dependencies": {
"database": { "status": "ok", "latencyMs": 4 },
"sorobanRpc": { "status": "ok", "latencyMs": 18 }
}
}

• 200 — all probes pass
• 503 — at least one probe fails (failing dependency identified in body)

Testing

npm test -- tests/recommendationsHealth.test.ts

28/28 tests pass. No auth required. All external I/O replaced by injectable stubs — no real DB
or network calls in tests.

Checklist

• Input validation at the boundary
• Standardised error envelope (via shared errorHandler)
• Structured logging with correlation IDs
• No authentication required (mirrors predictions/health, webhooks/health)
• Lint clean on changed files
• Documented in README and docs/recommendations-health.md
  closes Add /api/recommendations/health dependency probe [b#049] #623

[drips-wave]

@mrteeednut007-dotcom Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[greatest0fallt1me]

LGTM 🎉 merging now.