security: remove hardcoded secrets, add health endpoint, add security headers

dashboard/backend/main.py

@@ -43,6 +43,11 @@ async def monitor_containers():
 @app.on_event("startup")
 async def startup_event():
     asyncio.create_task(monitor_containers())
+
+@app.get("/api/health")
+async def health():
+    return {"status": "ok"}
+
 # Public auth endpoints
 app.include_router(auth.router, prefix="/api/auth", tags=["auth"])