feat: bypass security for health checks and support HEAD downloads

- Allow the `/health` endpoint to bypass the security middleware, ensuring container health checks succeed even if the proxy IP is banned.
- Add a test to verify health checks from banned IPs.
- Register a HEAD route for file downloads.
- Refactor admin alert status checks to use a new `isUnacknowledgedAlert` helper.
- Update the security runbook documentation with clearer instructions and examples for trusted proxy configuration.

lib/server/admin_security.go

@@ -103,6 +103,10 @@ func (app *App) createAlert(title string, severity string, group string, code st
 
 func (app *App) securityMiddleware() gin.HandlerFunc {
 	return func(ctx *gin.Context) {
+		if ctx.Request != nil && ctx.Request.URL != nil && ctx.Request.URL.Path == "/health" {
+			ctx.Next()
+			return
+		}
 		if !app.securityFeaturesEnabled() {
 			ctx.Next()
 			return