Fix healthcheck + external URL in silent auth middleware

- Add /health endpoint, update healthcheck to use it
- Use configured base URL instead of internal Docker URL
- Add /health to skip prefixes for silent auth

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/__init__.py

@@ -19,11 +19,22 @@ from artdag_common.middleware.auth import get_user_from_cookie
 from .config import settings
 
 # Paths that should never trigger a silent auth check
-_SKIP_PREFIXES = ("/auth/", "/static/", "/api/", "/ipfs/", "/download/", "/inbox")
+_SKIP_PREFIXES = ("/auth/", "/static/", "/api/", "/ipfs/", "/download/", "/inbox", "/health")
 _SILENT_CHECK_COOLDOWN = 300  # 5 minutes
 _DEVICE_COOKIE = "artdag_did"
 _DEVICE_COOKIE_MAX_AGE = 30 * 24 * 3600  # 30 days
 
+# Derive external base URL from oauth_redirect_uri (e.g. https://celery-artdag.rose-ash.com)
+_EXTERNAL_BASE = settings.oauth_redirect_uri.rsplit("/auth/callback", 1)[0]
+
+
+def _external_url(request: Request) -> str:
+    """Build external URL from request path + query, using configured base domain."""
+    url = f"{_EXTERNAL_BASE}{request.url.path}"
+    if request.url.query:
+        url += f"?{request.url.query}"
+    return url
+
 
 def create_app() -> FastAPI:
     """
@@ -80,7 +91,7 @@ def create_app() -> FastAPI:
                             auth_ts = r.get(f"did_auth:{device_id}")
                             if auth_ts and float(auth_ts) > pnone_ts:
                                 # Login happened since our last check — retry
-                                current_url = str(request.url)
+                                current_url = _external_url(request)
                                 return RedirectResponse(
                                     url=f"/auth/login?prompt=none&next={quote(current_url, safe='')}",
                                     status_code=302,
@@ -92,7 +103,7 @@ def create_app() -> FastAPI:
                 pass
 
         # Redirect to silent OAuth check
-        current_url = str(request.url)
+        current_url = _external_url(request)
         return RedirectResponse(
             url=f"/auth/login?prompt=none&next={quote(current_url, safe='')}",
             status_code=302,