fix(confidence-engine): sanitize public health response

tests/auth-boundary.test.js

@@ -58,15 +58,30 @@ describe("authenticated product boundary", () => {
     expect(magicLinkRedirectTo("http://localhost:3000")).toBe("http://localhost:3000/auth/callback");
   });
 
-  it("keeps infrastructure health public", async () => {
+  it("keeps infrastructure health public and does not leak config details", async () => {
+    mockGetConfig.mockReturnValue({ ok: true, config: {} });
+    const { GET } = await import("@/app/api/health/route.js");
+
+    const response = await GET();
+
+    expect(mockGetAuthenticatedUser).not.toHaveBeenCalled();
+    const body = await response.json();
+    expect(body).toHaveProperty("healthy");
+    // Must not expose private config details in the public response
+    expect(JSON.stringify(body)).not.toContain("baseUrl");
+    expect(JSON.stringify(body)).not.toContain("model");
+    expect(JSON.stringify(body)).not.toContain("ollama");
+  });
+
+  it("reports unhealthy generic state when config is missing", async () => {
     mockGetConfig.mockReturnValue({ ok: false });
     const { GET } = await import("@/app/api/health/route.js");
 
     const response = await GET();
 
     expect(response.status).toBe(500);
-    await expect(response.json()).resolves.toMatchObject({ configPresent: false });
-    expect(mockGetAuthenticatedUser).not.toHaveBeenCalled();
+    const body = await response.json();
+    expect(body).toEqual({ healthy: false });
   });
 
   it("does not convert /api/health to 401 via middleware when unauthenticated", async () => {