v2 CUA skeleton service

Service is alive. This is a bootstrap endpoint for remote deployment and calibration plumbing.

• GET /api/health
• GET /api/system/capabilities
• GET /api/system/preflight
• GET /api/calibration/status
• GET /api/actions/runs
• /calibration test page

Protected endpoints require Authorization: Bearer <token> when a secret is configured.