chore(ops): /api/health 增加 build 与 features 能力清单，便于部署自检

- 线上小程序请求新接口 404 时，可先 curl /api/health 确认线上构建版本与已包含能力
- features 覆盖：用户令牌/后台口令闸门/安全头/限流/5xx脱敏/令牌吊销/通知中心/服务包自助/优惠券/大神搜索
- 回归 96 套件/669 用例全绿

server/src/index.ts

@@ -196,7 +196,25 @@ app.get('/', (_req: Request, res: Response) => {
 });
 
 app.get('/api/health', (_req: Request, res: Response) => {
-  res.json({ status: 'healthy', database: 'connected', uptime: process.uptime() });
+  // features 用于部署自检：小程序请求新接口 404 时，可先 curl 本接口确认线上构建是否已更新
+  res.json({
+    status: 'healthy',
+    database: 'connected',
+    uptime: process.uptime(),
+    build: '2026-10-19',
+    features: {
+      userToken: true,
+      adminPasswordGate: true,
+      securityHeaders: true,
+      rateLimit: true,
+      errorSanitize: true,
+      adminTokenRevoke: true,
+      notifications: true,
+      expertServicesSelfManage: true,
+      coupons: true,
+      companionSearch: true,
+    },
+  });
 });
 
 // 统一校验用户是否处于封禁状态

server/tests/deploy-selfcheck.spec.ts

@@ -0,0 +1,19 @@
+// 已读取AGENTS.md
+import * as fs from 'fs';
+import * as path from 'path';
+
+/**
+ * 第八十批：部署自检（/api/health 回报构建能力，便于定位"小程序新、后端旧"的 404）。
+ */
+describe('第八十批部署自检闸门', () => {
+  const root = path.resolve(__dirname, '../../');
+  const indexCode = fs.readFileSync(path.join(root, 'server/src/index.ts'), 'utf-8');
+
+  it('/api/health 返回 build 与 features 能力清单', () => {
+    expect(indexCode).toContain('build: ');
+    expect(indexCode).toContain('features: {');
+    for (const f of ['notifications', 'coupons', 'companionSearch', 'expertServicesSelfManage', 'rateLimit', 'adminTokenRevoke']) {
+      expect(indexCode).toContain(`${f}: true`);
+    }
+  });
+});