feat: wire sidecar to platform — auth proxy with workspace subdomain, GraphQL proxy, health check

src/health/health.controller.ts

@@ -0,0 +1,38 @@
+import { Controller, Get, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import axios from 'axios';
+
+@Controller('api/health')
+export class HealthController {
+    private readonly logger = new Logger(HealthController.name);
+    private readonly graphqlUrl: string;
+
+    constructor(private config: ConfigService) {
+        this.graphqlUrl = config.get<string>('platform.graphqlUrl')!;
+    }
+
+    @Get()
+    async check() {
+        let platformReachable = false;
+        let platformLatency = 0;
+
+        try {
+            const start = Date.now();
+            await axios.post(this.graphqlUrl, { query: '{ __typename }' }, {
+                headers: { 'Content-Type': 'application/json' },
+                timeout: 5000,
+            });
+            platformLatency = Date.now() - start;
+            platformReachable = true;
+        } catch {
+            platformReachable = false;
+        }
+
+        return {
+            status: platformReachable ? 'ok' : 'degraded',
+            platform: { reachable: platformReachable, latencyMs: platformLatency },
+            ozonetel: { configured: !!process.env.EXOTEL_API_KEY },
+            ai: { configured: !!process.env.ANTHROPIC_API_KEY },
+        };
+    }
+}

src/health/health.module.ts

@@ -0,0 +1,7 @@
+import { Module } from '@nestjs/common';
+import { HealthController } from './health.controller';
+
+@Module({
+    controllers: [HealthController],
+})
+export class HealthModule {}