fix: batch 5 — input validation tightening + health check endpoint

- z.any() replaced with z.record(z.string()) on webhook headers
- availabilityJson typed with z.array(z.object({ start, end }))
- Frontend webhook headers converted from array to Record before API call
- Docker HEALTHCHECK added to Dockerfile (health endpoint already existed)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/server/routers/webhook.ts

@@ -81,7 +81,7 @@ export const webhookRouter = router({
         name: z.string().min(1).max(200),
         url: z.string().url(),
         events: z.array(z.string()).min(1),
-        headers: z.any().optional(),
+        headers: z.record(z.string()).optional(),
         maxRetries: z.number().int().min(0).max(10).default(3),
       })
     )
@@ -126,7 +126,7 @@ export const webhookRouter = router({
         name: z.string().min(1).max(200).optional(),
         url: z.string().url().optional(),
         events: z.array(z.string()).min(1).optional(),
-        headers: z.any().optional(),
+        headers: z.record(z.string()).optional(),
         isActive: z.boolean().optional(),
         maxRetries: z.number().int().min(0).max(10).optional(),
       })