Add safe backend database readiness endpoint

app/api/health.py

@@ -5,6 +5,7 @@ import shutil
 import time
 
 from fastapi import APIRouter, Request
+from fastapi.responses import JSONResponse
 
 from app.core.response import SuccessResponse
 
@@ -35,3 +36,52 @@ router.add_api_route("/health", _health, methods=["GET"], response_model=Success
 router.add_api_route(
     "/v1/health", _health, methods=["GET"], response_model=SuccessResponse, include_in_schema=False
 )
+
+
+async def _readiness(request: Request) -> JSONResponse:
+    """Report database/schema readiness without disclosing credentials or DSNs."""
+    container = request.app.state.container
+    database = container.security_database
+    try:
+        missing = await database.missing_schema_objects()
+    except Exception:
+        return JSONResponse(
+            status_code=503,
+            content={"status": "not_ready", "database": "unavailable", "schema_ready": False},
+        )
+    if missing:
+        return JSONResponse(
+            status_code=503,
+            content={
+                "status": "not_ready",
+                "database": "connected",
+                "schema_ready": False,
+                "missing_schema_objects": missing,
+            },
+        )
+    try:
+        await database.verify_execution_boundary(
+            expected_role=container.settings.security_database_role,
+            enforce_rls=container.settings.security_enforce_rls,
+        )
+    except Exception:
+        return JSONResponse(
+            status_code=503,
+            content={
+                "status": "not_ready",
+                "database": "connected",
+                "schema_ready": True,
+                "execution_role_ready": False,
+            },
+        )
+    return JSONResponse(
+        status_code=200,
+        content={
+            "status": "ready",
+            "database": "connected",
+            "schema_ready": True,
+            "execution_role_ready": True,
+        },
+    )
+
+router.add_api_route("/ready", _readiness, methods=["GET"], include_in_schema=False)