fix(auth): harden public infra routes

apps/fit/fit.yaml

@@ -201,6 +201,8 @@ spec:
     metadata:
       labels:
         app: fit-web
+      annotations:
+        flowercore.io/healthz-auth-policy: "allow-anonymous"
     spec:
       containers:
         - name: nginx
@@ -225,12 +227,18 @@ spec:
             httpGet:
               path: /healthz
               port: 80
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
             initialDelaySeconds: 5
             periodSeconds: 10
           readinessProbe:
             httpGet:
               path: /healthz
               port: 80
+              httpHeaders:
+                - name: X-Forwarded-Proto
+                  value: https
             initialDelaySeconds: 3
             periodSeconds: 5
       volumes:
@@ -265,7 +273,7 @@ spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`flowerinsider.xyz`) || Host(`www.flowerinsider.xyz`)
+    - match: (Host(`flowerinsider.xyz`) || Host(`www.flowerinsider.xyz`)) && (Method(`GET`) || Method(`HEAD`))
       kind: Rule
       services:
         - name: fit-web