auth-svc — see /healthz and /api/auth/*