Platform liveness check
Unauthenticated liveness probe. Returns immediately without any database read, token verification, or tenant resolution, mounted ahead of the auth layer so load balancers and POS terminals can gate feature availability without holding a key. When all subsystems are nominal the response is { ok: true, status: 'up', degraded_subsystems: [] }. A non-empty degraded_subsystems array indicates a partial outage; the POS should surface a warning but may continue operations that are not degraded. This endpoint carries no tenant data.
Response
Platform is live (or partially degraded, inspect degraded_subsystems).
Unauthenticated liveness response. This payload requires no credentials and contains no tenant-scoped data. The degraded_subsystems array is empty when the service is nominal, and lists the affected subsystems otherwise.
Always true on HTTP 200, the platform is reachable.
up = all subsystems nominal. degraded = one or more subsystems impaired but platform is still serving.
up, degraded Named subsystems currently impaired (e.g. ['promo_engine', 'webhook_fanout']). Empty when status is up.