feat(canopy-api): production hardening — liveness/readiness separation, HSTS, admin replay

External review (2026-05-09) found CRAIG has more robust API-server behavior canopy should adopt:

• Separate /healthz (liveness — process alive) from /readyz (readiness — dependencies up). Today canopy collapses both into /healthz. K8s and similar orchestrators behave better with separation.
• HSTS header on all responses.
• Admin replay hooks for failed event processing (paired with #DLQ-issue).

References: craig-api/src/lib.rs:91, :150, :311.

Refs

External review (2026-05-09).