feat(p1.7): relay health check page

[attson]

Summary

Implements P1.7 from the roadmap: relay-side diagnostics so operators can verify version, HTTPS, origins, bootstrap-admin status, rate limits, and active uplink count at a glance — plus a copyable plaintext blob.

• GET /healthz — public, no auth, returns {ok:true, version} with Cache-Control: no-store. Suitable for K8s liveness probes and load balancer health checks.
• GET /admin/api/health — admin Bearer-gated, returns full HealthPayload JSON (the same shape consumers see from the copy button).
• GET /admin/health — admin Bearer-gated, server-rendered HTML page (Go html/template, no Vue dep, no build step) with a "Copy diagnostics" button.
• Active uplinks count — new atomic int64 on Server, incremented in handleUplinkHTTP right after websocket.Accept succeeds, decremented on connection close.
• Mobile origin compatibility check — utility isMobileOriginCompatible that detects whether AllowedOrigins admits capacitor://*, ionic://*, https://localhost*, or null. Surfaced as a one-glance flag on the page.

Every field in HealthPayload is either a configured value or an aggregate count — no PII, no token prefixes, no IP addresses, no file paths. The page and the copy-diagnostics text share the same data; no separate redaction layer needed.

Spec: docs/superpowers/specs/2026-05-31-relay-health-page-design.md
Plan: docs/superpowers/plans/2026-05-31-relay-health-page.md

Test Plan

• go test ./... — green
• go vet ./... — clean
• go build ./cmd/atterm-relay — clean
• 10 sub-cases for TestIsMobileOriginCompatible (Capacitor / Ionic / localhost / null / wails-only / mixed)
• collectHealth populates every documented field on a real Server + in-memory store
• /healthz returns 200 + ok+version, no auth required, Cache-Control: no-store
• /admin/api/health returns 401 unauthed, 401 for regular user, 200 + full payload for admin Bearer
• /admin/health returns 401 unauthed, 200 + every label + window.__HEALTH__ injection for admin
• TestHealthPayload_JSONFieldsStable contract test pins the 11 JSON field names
• TestUplinkCount_IncrementsOnConnectDecrementsOnClose drives a real WebSocket through /uplink, asserts counter moves 0 → 1 → 0
• manual: go run ./cmd/atterm-relay --dev-insecure --addr :8080, then curl /healthz and visit /admin/health after admin login — confirm UI matches spec §7