fix: harden health and CLI secret handling (RUN5.08, RUN5.09)

[egerev]

Summary

Closes 2 P3 hardening items from the Codex security audit:

• RUN5.08 (SBP-005): /health/ready now redacts internal check details by default. Verbose payload (component status, first_run flag, etc.) is gated behind ALAYA_HEALTH_READY_VERBOSE. /health/live remains untouched (anonymous, full).
• RUN5.09 (SBP-006): alaya setup agent no longer prints the API key by default — opt-in via --show-secret. Stderr warning emitted when the flag is used.

Plus a CLI bootstrap fix: parses data.raw_key from the new envelope shape, with fallback to top-level raw_key for backwards compat with older API responses.

Plus a perf fix: /health/ready no longer instantiates Settings() on every request — uses cached get_settings() (k8s probes hit this every 5–10s × N replicas).

Spec

• BACKLOG: RUN5.08, RUN5.09
• Audit: docs/audits/2026-04-13-security-best-practices.md (SBP-005, SBP-006)

Code review (Claude, standard re-review after fixes)

Initial review found 2 IMPORTANT + 2 MINOR. Re-review verdict: APPROVE with one explicit deferral.

✅ Settings caching via @lru_cache get_settings() — test_health_ready_uses_cached_settings proves factory.call_count == 1 across 2 requests
✅ Stderr warning before printing secret (via cmd.ErrOrStderr() Cobra idiom)
✅ Envelope parser is defensive: reads data.raw_key first, falls back to top-level raw_key, errors only if both empty
✅ /health/live untouched, remains anonymous

Deferred (acknowledged P3 debt):

• Verbose-readiness gating remains an env toggle (ALAYA_HEALTH_READY_VERBOSE), not admin-key-gated. Spec asked for admin-verbose / anonymous-terse but env toggle is acceptable for P3. Track as follow-up: gate via require_scope("admin") similar to /api-keys.

Non-blocking polish (deferred):

• @lru_cache requires manual cache_clear() in tests; cleaner as Depends(get_settings) with app.dependency_overrides
• No unit test for legacy top-level raw_key fallback path
• auth.SetAPIKey persistence not directly asserted in tests

Test plan

• Local: pytest test_routers_health.py → 5 passed
• Local: go test ./internal/cmd/... → ok
• CI green
• Manual: alaya setup agent → key not printed; --show-secret → warning on stderr + key printed

🤖 Generated with Claude Code