fix(api): implement /readyz with real DB + K8s API + CRD checks (§7)

Previously /readyz only verified Repo != nil && Cluster != nil — a
process-liveness check, not a dependency-health check. The spec
requires the readyz probe to verify DB, K8s API, and CRD informer
are live before declaring the pod ready.

- Repo interface gains Ping(context.Context) error
- Cluster interface gains Ping(context.Context) error
- PGRepo.Ping delegates to sql.DB.PingContext
- K8sCluster.Ping lists MinecraftServer CRDs (Limit=1) in the
  configured namespace, exercising both the API and CRD informer
- handleReadyz iterates ping checks; any failure returns 503 with
  the failing dependency name in the error message
- fakeRepo and fakeCluster gain configurable pingErr for hermetic
  test coverage of the failure paths

New test: TestReadyzPingsDependencies verifies 200 when healthy,
503 when DB or K8s API is down.

internal/api/repo.go

@@ -145,6 +145,10 @@ type OpLoginRequest struct {
 // so handlers are tested against an in-memory fake; the Postgres implementation
 // (pgRepo) is integration-tested only — it requires a live database.
 type Repo interface {
+	// Ping probes the database — used by the /readyz endpoint (spec §7) to verify
+	// the DB connection is alive.
+	Ping(ctx context.Context) error
+
 	// ServerBySubdomain resolves a subdomain alias to its server, or ErrNotFound.
 	ServerBySubdomain(ctx context.Context, subdomain string) (*ServerRecord, error)
 	// ServerByName loads a server's business projection, or ErrNotFound.