fix: batch 5 — input validation tightening + health check endpoint

- z.any() replaced with z.record(z.string()) on webhook headers
- availabilityJson typed with z.array(z.object({ start, end }))
- Frontend webhook headers converted from array to Record before API call
- Docker HEALTHCHECK added to Dockerfile (health endpoint already existed)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker/Dockerfile

@@ -69,5 +69,8 @@ EXPOSE 7600
 ENV PORT=7600
 ENV HOSTNAME="0.0.0.0"
 
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 \
+  CMD wget -qO- http://localhost:7600/api/health || exit 1
+
 # Run via entrypoint (migrate then start)
 CMD ["/app/docker-entrypoint.sh"]