fix: add tiered auth to Privacy Shield /health and /stats endpoints

[yasinBursali]

Summary

• /health and /stats had no authentication while catch-all proxy routes did
• /health leaked the target LLM API URL and session count; /stats leaked PII scrubbing volume metrics
• Both endpoints now use tiered responses: unauthenticated callers get non-sensitive base fields only (preserving Docker healthcheck and dashboard-api compatibility), authenticated callers get full operational details
• Uses Security(security_scheme, auto_error=False) with secrets.compare_digest for timing-safe optional auth

Test plan

• curl http://localhost:8085/health returns only {status, service, version} — no target_api
• curl -H "Authorization: Bearer $KEY" http://localhost:8085/health returns all fields
• curl http://localhost:8085/stats returns only {cache_enabled, cache_size} — no PII counts
• curl -H "Authorization: Bearer $KEY" http://localhost:8085/stats returns all fields
• Docker healthcheck still passes (200 OK without auth)
• Dashboard privacy stats page still loads (dashboard-api calls /stats without auth)

🤖 Generated with Claude Code