Support HEAD for public GET routes

[espadonne]

Context

Production currently returns 405 Method Not Allowed for HEAD /, while GET / returns 200. HEAD /healthz is already handled explicitly.

This is not a production outage, but public GET routes should generally support HEAD with the same status/headers and an empty body. This matters for uptime checks, crawlers, proxies/CDNs, SEO tooling, and GitHub-like behavior.

Acceptance criteria

• HEAD / returns 200 with no response body.
• Public GET pages return the same status and important headers for HEAD as GET.
• HEAD /healthz continues returning 200.
• Non-GET-only routes do not accidentally become reachable via HEAD.
• Add focused handler tests.