fix: batch 5 — input validation tightening + health check endpoint

- z.any() replaced with z.record(z.string()) on webhook headers
- availabilityJson typed with z.array(z.object({ start, end }))
- Frontend webhook headers converted from array to Record before API call
- Docker HEALTHCHECK added to Dockerfile (health endpoint already existed)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/server/routers/user.ts

@@ -106,7 +106,7 @@ export const userRouter = router({
         notificationPreference: z.enum(['EMAIL', 'WHATSAPP', 'BOTH', 'NONE']).optional(),
         expertiseTags: z.array(z.string()).max(15).optional(),
         digestFrequency: z.enum(['none', 'daily', 'weekly']).optional(),
-        availabilityJson: z.any().optional(),
+        availabilityJson: z.array(z.object({ start: z.string(), end: z.string() })).optional(),
         preferredWorkload: z.number().int().min(1).max(100).optional().nullable(),
       })
     )
@@ -539,7 +539,7 @@ export const userRouter = router({
         status: z.enum(['NONE', 'INVITED', 'ACTIVE', 'SUSPENDED']).optional(),
         expertiseTags: z.array(z.string()).optional(),
         maxAssignments: z.number().int().min(1).max(100).optional().nullable(),
-        availabilityJson: z.any().optional(),
+        availabilityJson: z.array(z.object({ start: z.string(), end: z.string() })).optional(),
         preferredWorkload: z.number().int().min(1).max(100).optional().nullable(),
       })
     )

src/server/routers/webhook.ts

@@ -81,7 +81,7 @@ export const webhookRouter = router({
         name: z.string().min(1).max(200),
         url: z.string().url(),
         events: z.array(z.string()).min(1),
-        headers: z.any().optional(),
+        headers: z.record(z.string()).optional(),
         maxRetries: z.number().int().min(0).max(10).default(3),
       })
     )
@@ -126,7 +126,7 @@ export const webhookRouter = router({
         name: z.string().min(1).max(200).optional(),
         url: z.string().url().optional(),
         events: z.array(z.string()).min(1).optional(),
-        headers: z.any().optional(),
+        headers: z.record(z.string()).optional(),
         isActive: z.boolean().optional(),
         maxRetries: z.number().int().min(0).max(10).optional(),
       })