feat(health): add unauthenticated GET /health endpoint

Returns 200 { status: 'ok' } for container healthchecks and
monitoring. Placed before all /api/* routes so it bypasses
auth; intentionally static with no DB dependency so the
container reports healthy whenever the process is serving.

app.js

@@ -43,6 +43,8 @@ const limiter = rateLimit({
 
 app.use(express.json(), cookieParser(), morgan('dev'), mongoSanitize(), helmet(), xss(), limiter, hpp(), cors())
 
+app.get('/health', (req, res) => res.status(200).json({ status: 'ok' }))
+
 app.use('/api/admin/games', adminGames)
 app.use('/api/games', games)
 app.use('/api/tags', tags)