feat(http): implement /healthz raw route and stealth decoy fallback

GET /healthz: raw route, no auth, no OperationContext, returns 200 OK
with plain-text 'ok' (ADR-036). Decoy fallback for unknown paths via
DecoyConfig: fake nginx 404 (default), static site serving, or redirect.
Decoy does not leak alknet presence (no alknet headers/format). Custom
routes take precedence over decoy (decoy is fallback only). Wire real
handlers into HttpAdapter router replacing placeholder 501s.

Cargo.lock

@@ -110,6 +110,7 @@ dependencies = [
  "axum",
  "futures",
  "http",
+ "http-body-util",
  "httpdate",
  "hyper",
  "hyper-util",
@@ -122,6 +123,7 @@ dependencies = [
  "serde_json",
  "thiserror 2.0.18",
  "tokio",
+ "tower",
  "tracing",
  "url",
  "uuid",