chore(release): assure, prune, and sync docs for v1.1.25

- Cut new release tag v1.1.25.
- Document BOLT's optimization (moving /health endpoint above helmet/cors).
- Update dependencies to the latest patch/minor versions.
- Log lifecycle status in Warden ledger and update Changelog.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: shenald-dev <245350826+shenald-dev@users.noreply.github.com>

Author: shenald-dev

.jules/warden.md

@@ -132,3 +132,9 @@ Observation / Pruned:
 Assessed JULES/BOLT's optimization changing global `express.json` middleware into a route-specific middleware. This prevents unhandled routes (e.g. 404s) from attempting to buffer and parse large JSON payloads, saving CPU cycles and mitigating DoS vectors. The JSON error handler was effectively moved correctly to preserve functionality. Ran full tests and robustness scripts to verify correct validation edge cases pass. Zero unused files or exports were identified for pruning.
 Alignment / Deferred:
 Appended release notes for performance and security patch. Version bumped to 1.1.24.
+
+2026-04-27 — Assessment & Lifecycle
+Observation / Pruned:
+Assessed BOLT's optimization moving the `/health` endpoint above `helmet()` and `cors()` middlewares, while manually setting `Content-Type`. This effectively prevents parsing and middleware overhead for frequent health check pings without compromising the expected response headers. Also bumped minor/patch versions via `npm update`. No dead code or unused files found, as previous optimizations have pruned effectively.
+Alignment / Deferred:
+Appended release notes for performance patch. Version bumped to 1.1.25.

CHANGELOG.md

@@ -1,3 +1,7 @@
+## v1.1.25 - 2026-04-27
+### Changed
+- **Performance:** Moved the `/health` endpoint above `helmet()` and `cors()` middlewares, saving significant CPU cycle overhead on load balancer pings by skipping unnecessary security header injections and CORS processing for this specific endpoint. No dead code pruned.
+
 ## v1.1.24 - 2026-04-25
 ### Changed
 - **Security/Performance:** Modified the `express.json()` middleware to act as a route-specific middleware on `/v1/chat/completions` rather than globally. This prevents unnecessary JSON parsing for non-existent endpoints (like 404 routes), mitigating potential CPU exhaustion DoS vectors from large arbitrary payloads.

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "one-api",
-  "version": "1.1.24",
+  "version": "1.1.25",
   "description": "One API to rule them all. Unified gateway for 20+ LLM providers. OpenAI-compatible, single binary, zero config.",
   "main": "src/index.js",
   "scripts": {