fix: health check uses isReachable() instead of authenticated find()

Payload API returns 403 without auth, which is fine for health checks.
New isReachable() method accepts any non-5xx response as healthy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/payload/PayloadClient.ts

@@ -45,6 +45,16 @@ export class PayloadClient {
     })
   }
 
+  async isReachable(): Promise<boolean> {
+    try {
+      const response = await fetch(this.baseUrl, { method: 'GET' })
+      // Any HTTP response (even 401/403) means the API is alive
+      return response.status < 500
+    } catch {
+      return false
+    }
+  }
+
   private async request<T>(url: string, init?: RequestInit): Promise<T> {
     const headers: Record<string, string> = {
       'Content-Type': 'application/json',

src/server.ts

@@ -137,13 +137,7 @@ app.post('/webhook', webhookHandler)
 // Health check
 app.get('/health', async () => {
   const redisOk = redis.status === 'ready'
-  let payloadOk = false
-  try {
-    await payloadClient.find('users', { limit: '0' })
-    payloadOk = true
-  } catch {
-    // Payload API down
-  }
+  const payloadOk = await payloadClient.isReachable()
 
   const status = redisOk && payloadOk ? 'ok' : 'degraded'
   return {