docs: sync from backend 8e03360 — auth health hotfix

09 - Audits/Activity Log.md

@@ -11,6 +11,18 @@ entries on top. Maintained by agents per the rule in `../AGENTS.md`.
 
 ---
 
+### 2026-05-31 — backend@8e03360, frontend@228eed2 — keep auth and health checks resilient under load
+
+**Commits:** backend `8e03360`, frontend `228eed2` (backend `2.6.84`, frontend `2.7.24`)
+**Touched:**
+- Backend: `src/app.ts`, `src/services/health/healthCheckService.ts`, `package.json`, `package-lock.json`
+- Frontend: `package.json`, `package-lock.json` version bump only.
+**Why:** A dev performance run consumed the global 100/15m limiter and blocked `/api/auth/login`; repeated `/api/health` calls also drove the external Request Network reachability probe into `429`, making Gatus report `status: degraded` even though Mongo/Redis/app were healthy. Auth routes now bypass the global limiter and rely on the auth-specific limiter, and the RN health subcheck is cached and treats non-5xx HTTP responses as upstream reachable.
+**Verification:** Backend `npm test -- --runTestsByPath __tests__/health-check.test.ts`; backend `npm run typecheck`; backend `git diff --check`; frontend `npx tsc --noEmit --ignoreDeprecations 6.0`; frontend `git diff --check`. Dev login was manually verified after resetting the backend limiter state.
+**Linked docs updated:** [[Monitoring]], [[Gatus Monitoring - Proposed Config]]
+
+---
+
 ### 2026-05-31 — backend@cbc32dc, frontend@08e8da9 — seller-owned template delivery and payment rails
 
 **Commits:** backend `cbc32dc`, frontend `08e8da9` (backend `2.6.83`, frontend `2.7.23`)