feat(observability): add /healthz to Platform API and Gateway

Unauthenticated liveness/readiness probes for uptime monitoring and Ansible
deploy smoke tests (Phase 4). API's checks Postgres reachability via
SELECT 1; Gateway's answers locally without proxying anywhere, so it can
distinguish 'Gateway itself is down' from 'something behind it is down'.
No student/instructor data exposed.

Verified live against the real dev stack: both return 200 with the
expected JSON body. Full regression suite re-run after this change:
e2e-phase2a (10/10), e2e-phase2b (12/12), e2e-phase3a (21/21), e2e-phase3b
(24/24) - all passing, no regressions. Frontend build and the Lab image
(both the multi-service dev compose and the standalone single-container
Dockerfile) also confirmed still building/booting correctly.

platform/gateway/src/server.js

@@ -49,6 +49,12 @@ proxy.on('error', (err, req, res) => {
   }
 });
 
+// GET /healthz — the Gateway's own liveness check, answered locally without proxying anywhere
+// (Phase 4, docs/OBSERVABILITY.md §"uptime checks"). Deliberately doesn't depend on Platform
+// API/Provisioner being reachable, so it can distinguish "Gateway itself is down" from
+// "something behind it is down" for alerting.
+app.get('/healthz', (req, res) => res.json({ ok: true }));
+
 function parseCookies(req) {
   const header = req.headers.cookie;
   if (!header) return {};