Controller with a constrained token incorrectly claims Garage is unreachable due to a HTTP403

[bmarinov]

Describe the bug
A token with constrained permissions (as documented in the readme) has no permission on the GetClusterHealth endpoint. The metric incorrectly shows cluster unreachable.

To Reproduce
Steps to reproduce the behavior:

1. Create admin account token with recommended scopes
2. Start controller
3. Check logs and metrics

Expected behavior
Garage reported as reachable

Logs

{"level":"info","ts":"2026-07-30T06:51:53Z","logger":"preflight","msg":"garage admin API reachable, token accepted","token":"controller-admin-token","scopes":["CreateKey","GetKeyInfo","DeleteKey","CreateBucket","GetBucketInfo","UpdateBucket","AllowBucketKey","DenyBucketKey","ListBuckets","DeleteBucket"]}
{"level":"info","ts":"2026-07-30T06:51:53Z","logger":"setup","msg":"starting manager"}
{"level":"info","ts":"2026-07-30T06:51:53Z","logger":"controller-runtime.metrics","msg":"Starting metrics server"}
{"level":"error","ts":"2026-07-30T06:51:53Z","logger":"heartbeat","msg":"garage admin API unreachable","error":"garage admin api health: forbidden (status 403)","stacktrace":"github.com/bmarinov/garage-storage-controller/internal/health.run\n\t/workspace/internal/health/heartbeat.go:67\ngithub.com/bmarinov/garage-storage-controller/internal/health.Run\n\t/workspace/internal/health/heartbeat.go:46"}

Additional context
The controller is using two different endpoints to check Garage connectivity. GetClusterHealth is not really needed and not worth the additional scope.