fix: /health 返回纯文本 "ok" 替代 JSON，隐藏 FastAPI 后端指纹

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/api/health.py

@@ -7,7 +7,8 @@ Detailed health diagnostics require admin JWT auth via /health/detail.
 
 import logging
 
-from fastapi import APIRouter, Depends, HTTPException
+from fastapi import APIRouter, Depends
+from fastapi.responses import PlainTextResponse
 from sqlalchemy import text
 
 from server.api.auth_jwt import get_current_admin
@@ -21,13 +22,14 @@ logger = logging.getLogger("nexus.health")
 router = APIRouter()
 
 
-@router.get("/health")
+@router.get("/health", response_class=PlainTextResponse)
 async def health_check():
-    """Minimal health check — used by Shell health_monitor.sh.
-    Only returns {"status": "ok"} if Python is alive.
-    No infrastructure details exposed to unauthenticated callers.
+    """Minimal health check — used by Shell health_monitor.sh (Layer 3 guardian).
+    Returns plain-text "ok" — no JSON, no backend fingerprint.
+    health_monitor.sh discards response body (curl -sf > /dev/null),
+    so this is purely for HTTP status code.
     """
-    return {"status": "ok"}
+    return "ok"
 
 
 @router.get("/health/detail")