fix(observability): declare the health checks the endpoint reports

[rubenvdlinde]

#666 wired /api/health and /api/metrics to OpenRegister's generic controllers, which was the binding larpinq was missing. This adds the thing those controllers read.

HealthCheckExecutor iterates the manifest's observability descriptors. With no observability block it iterates an empty list, so /api/health answers 200 with an empty checks object — it would report ok with the database down, which is the one thing a health endpoint must never do.

Two checks, matching shillinq's: database (critical) and openregister (degraded). Metrics stay the implicit larpinq_info / larpinq_up gauges the engine adds.

Verified against a live instance, while an equivalent binding was in place:

GET /apps/larpinq/api/health   -> 200 {"status":"ok","app":"larpinq",
                                       "checks":{"database":"ok","openregister":"ok"}}
GET /apps/larpinq/api/metrics  -> 401  (admin-only per ADR-006)

Those are exactly the two checks this block declares — that response is what the block buys.

Also: a CodeQL high finding. settings-roadmap.spec.ts builds its URL pattern with a slash-only escape, which CodeQL reports as js/incomplete-sanitization — it leaves ., ?, +, ( and backslash live in the pattern. Nothing is exploitable, since every route in that file is a literal, but a route containing a . would silently match more than it names. Widened to the full metacharacter set.

On the separate prettier commit: src/manifest.json was never prettier-clean, and Frontend Check (format) is scoped to changed files rather than changed lines, so any edit to the manifest fails that job until it is formatted once. Kept as its own commit, and the JSON parses to an identical structure before and after.

---

This replaces #665, which I have closed. That PR bound the routes via AppHost\Bootstrap::register(); #666 landed a hand-rolled alias doing the same job while it was open, so only this part is still additive.

[github-actions]

Quality Report — ConductionNL/larpinq @ 97906c0

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 105/105
npm			✅	✅ 525/525
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					⏭️ deferred — runs on the promotion into beta/main, not on a pull request into development
Hydra gates					✅

---

Quality workflow — 2026-09-01 22:11 UTC

Download the full PDF report from the workflow artifacts.