feat: add production deployment and runtime safeguards

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/server.test.mjs

@@ -0,0 +1,37 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { openDb } from '../src/db.mjs';
+import { createAppServer } from '../src/server/index.mjs';
+
+async function startTestServer() {
+  const db = openDb(':memory:');
+  const jobs = { subscribe: () => null, activeJobs: () => [] };
+  const whatsapp = {
+    getStatus: () => ({ state: 'READY', connected: true }),
+    sendText: async () => { throw new Error('sendText nao deveria ser chamado'); }
+  };
+  const server = createAppServer({ db, jobs, whatsapp });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const baseUrl = `http://127.0.0.1:${server.address().port}`;
+  const close = async () => {
+    await new Promise((resolve) => server.close(resolve));
+    db.close();
+  };
+  return { server, baseUrl, close };
+}
+
+test('health endpoint is public and does not expose secrets', async () => {
+  const { server, baseUrl, close } = await startTestServer();
+  try {
+    const res = await fetch(`${baseUrl}/api/health`);
+    assert.equal(res.status, 200);
+    const body = await res.json();
+    assert.equal(body.ok, true);
+    assert.ok(body.app);
+    assert.ok(body.database);
+    assert.ok(body.whatsapp);
+    assert.doesNotMatch(JSON.stringify(body), /token|password|secret|cookie/i);
+  } finally {
+    await close(server);
+  }
+});