fix(server): pre-check credit balance before health-check AI analysis

The health-check endpoint runs the paid OpenAI analysis before charging
(failed analyses are intentionally not charged). Without a balance
pre-check, a user below HEALTH_CHECK_COST could trigger unlimited free
analyses with fresh idempotency keys.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/test/billing.test.js

@@ -5,6 +5,7 @@ const {
   alignAccountToCurrentCycle,
   getAvailableCredits,
   consumeCredits,
+  ensureSufficientCredits,
   getMonthlyAllowanceForPlan,
 } = require('../lib/billing');
 
@@ -72,3 +73,18 @@ test('monthly cycle rollover resets free usage', () => {
   assert.equal(aligned.monthlyAllowance, 3);
   assert.equal(getAvailableCredits(aligned), 3);
 });
+
+test('ensureSufficientCredits throws 402 when balance is below cost', () => {
+  const account = freeAccount({ monthlyAllowance: 3, usedThisCycle: 2, topupBalance: 0 });
+  assert.throws(() => ensureSufficientCredits(account, 2), (error) => {
+    assert.equal(error.code, 'INSUFFICIENT_CREDITS');
+    assert.equal(error.status, 402);
+    assert.deepEqual(error.metadata, { required: 2, available: 1 });
+    return true;
+  });
+});
+
+test('ensureSufficientCredits passes when balance covers cost', () => {
+  const account = freeAccount({ monthlyAllowance: 3, usedThisCycle: 1, topupBalance: 0 });
+  assert.doesNotThrow(() => ensureSufficientCredits(account, 2));
+});