feat: Add /api/health endpoint and backend healthcheck

The tenant interceptor treats `/api/health` as a public endpoint (tenant-query.interceptor.ts:38), but no controller implements it. The backend service also has no `healthcheck` in docker-compose.yml (only postgres and redis do), so orchestration can't verify backend liveness.

Start with tenant-query.interceptor.ts:38 to confirm the public /api/health path, then inspect existing backend controllers and docker-compose.yml. Add the health endpoint and the backend service healthcheck, and verify that the endpoint responds successfully and Docker Compose can use it for liveness.

Written by the indexing model from the issue text.