feat: global Docker health indicator and graceful degradation

- GET /api/health endpoint returning Docker connectivity status
- Sidebar shows Docker connection dot (green=connected, red=disconnected)
- Stale scanner returns store-only results when Docker is unavailable
- Polls health every 30s

internal/api/health.go

@@ -0,0 +1,25 @@
+package api
+
+import (
+	"context"
+	"net/http"
+	"time"
+)
+
+// getHealth handles GET /api/health.
+// Returns connectivity status for Docker and other services.
+func (s *Server) getHealth(w http.ResponseWriter, r *http.Request) {
+	ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
+	defer cancel()
+
+	dockerOK := false
+	if s.docker != nil {
+		if err := s.docker.Ping(ctx); err == nil {
+			dockerOK = true
+		}
+	}
+
+	respondJSON(w, http.StatusOK, map[string]any{
+		"docker": dockerOK,
+	})
+}

internal/api/router.go

@@ -130,6 +130,7 @@ func (s *Server) Router() chi.Router {
 			r.Use(auth.Middleware(s.localAuth))
 
 			// Read-only endpoints (any authenticated user).
+			r.Get("/health", s.getHealth)
 			r.Get("/auth/me", s.currentUser)
 			r.Get("/projects", s.listProjects)
 			r.Route("/projects/{id}", func(r chi.Router) {