fix(server): pre-check credit balance before health-check AI analysis

The health-check endpoint runs the paid OpenAI analysis before charging
(failed analyses are intentionally not charged). Without a balance
pre-check, a user below HEALTH_CHECK_COST could trigger unlimited free
analyses with fresh idempotency keys.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/index.js

@@ -51,6 +51,7 @@ const {
   getAccountSnapshot,
   getBillingSummary,
   getEndpointResponse,
+  ensureSufficientCredits,
   isInsufficientCreditsError,
   claimNotificationOnce,
   simulatePurchase,
@@ -943,6 +944,10 @@ app.post('/v1/health-check', async (request, response) => {
 
     const accountSnapshot = await getAccountSnapshot(db, userId);
     ensureNotGuest(userId, HEALTH_CHECK_COST);
+    // Balance pre-check: the paid AI analysis below runs BEFORE the charge
+    // (failed analyses are intentionally not charged), so without this check a
+    // user with insufficient credits could trigger unlimited free analyses.
+    ensureSufficientCredits(accountSnapshot, HEALTH_CHECK_COST);
 
     if (!isOpenAiConfigured()) {
       const error = new Error('OpenAI health check is unavailable. Please configure OPENAI_API_KEY.');