Skip auth check on /healthz endpoint

The gateway health check calls /healthz without auth headers.
Move the healthz route before the auth check.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ts-worker/server.ts

@@ -81,18 +81,18 @@ async function handleRequest(
   req: Request,
   state: WorkerState,
 ): Promise<Response> {
-  const authErr = checkAuth(req, state)
-  if (authErr) return authErr
-
   const url = new URL(req.url)
   const path = url.pathname
   const method = req.method
 
-  // ── Health ────────────────────────────────────────────────────────
+  // ── Health (unauthenticated) ──────────────────────────────────────
   if (method === 'GET' && path === '/healthz') {
     return new Response('ok')
   }
 
+  const authErr = checkAuth(req, state)
+  if (authErr) return authErr
+
   // ── Status ────────────────────────────────────────────────────────
   if (method === 'GET' && path === '/v1/status') {
     const status: WorkerStatusResponse = {