docs: add secure strategy health sync drop-in

[Pigbibi]

Summary

• document the root-owned systemd drop-in for the opt-in VPS health publisher
• keep the dedicated sync token in a file outside the unit environment
• add regression coverage for the separate ingress boundary

Safety

• no credential value is committed
• health publishing stays read-only and uses a dedicated token

Verification

• pytest -q ops/quant-monitor/tests/test_deploy_scripts.py ops/quant-monitor/tests/test_dashboard_scripts.py