Add minimal web surface: health, config, provisioning

[next-nf]

No web UI today. Add /health (state summary), /config (redacted), and a provisioning endpoint; extend http_api_handler/smf_http_api or a new web app.
Accept: the three surfaces respond; secrets redacted.

Epic: next-nf/next-nf#15