platform: Harden health endpoints

[jeromehardaway]

Intent

Health endpoints don't disclose operational data: api/lms/health publicly returns user counts and sample course data.

Scope

• Auth or reduce api/lms/health output.
• Optional non-blocking J0dI3 substatus on api/health for observability — platform health must never depend on J0dI3.

Acceptance criteria

• No operational counts on public endpoints
• Platform health independent of J0dI3
• Tests

Touches: Cross-cutting; invariant 5.