fix: batch 5 — input validation tightening + health check endpoint

- z.any() replaced with z.record(z.string()) on webhook headers
- availabilityJson typed with z.array(z.object({ start, end }))
- Frontend webhook headers converted from array to Record before API call
- Docker HEALTHCHECK added to Dockerfile (health endpoint already existed)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/server/routers/user.ts

@@ -106,7 +106,7 @@ export const userRouter = router({
         notificationPreference: z.enum(['EMAIL', 'WHATSAPP', 'BOTH', 'NONE']).optional(),
         expertiseTags: z.array(z.string()).max(15).optional(),
         digestFrequency: z.enum(['none', 'daily', 'weekly']).optional(),
-        availabilityJson: z.any().optional(),
+        availabilityJson: z.array(z.object({ start: z.string(), end: z.string() })).optional(),
         preferredWorkload: z.number().int().min(1).max(100).optional().nullable(),
       })
     )
@@ -539,7 +539,7 @@ export const userRouter = router({
         status: z.enum(['NONE', 'INVITED', 'ACTIVE', 'SUSPENDED']).optional(),
         expertiseTags: z.array(z.string()).optional(),
         maxAssignments: z.number().int().min(1).max(100).optional().nullable(),
-        availabilityJson: z.any().optional(),
+        availabilityJson: z.array(z.object({ start: z.string(), end: z.string() })).optional(),
         preferredWorkload: z.number().int().min(1).max(100).optional().nullable(),
       })
     )