improved debugging + health endpoint

handlers/health.php

@@ -0,0 +1,42 @@
+<?php
+/**
+ * GET /api/health — verify FPM sees the same project root, key, and DB as CLI.
+ */
+if ($method !== 'GET') {
+    json_error('METHOD_NOT_ALLOWED', 'Method not allowed', 405);
+}
+
+$dbOpenOk = false;
+$dbError  = null;
+try {
+    [$pdo, $tmpDb, $lockFp] = qdb_open(false);
+    qdb_discard($tmpDb, $lockFp);
+    $dbOpenOk = true;
+} catch (Throwable $e) {
+    $dbError = $e->getMessage();
+}
+
+$keySha = null;
+$keyError = null;
+try {
+    $keySha = hash('sha256', get_master_key_bytes());
+} catch (Throwable $e) {
+    $keyError = $e->getMessage();
+}
+
+json_success([
+    'sapi'          => PHP_SAPI,
+    'projectRoot'   => realpath(__DIR__ . '/..') ?: (__DIR__ . '/..'),
+    'commonFile'    => realpath(__DIR__ . '/../common.php') ?: (__DIR__ . '/../common.php'),
+    'commonMtime'   => @filemtime(__DIR__ . '/../common.php') ?: 0,
+    'envFile'       => qdb_env_file_path(),
+    'envReadable'   => is_readable(qdb_env_file_path()),
+    'keySha256'     => $keySha,
+    'keyError'      => $keyError,
+    'dbPath'        => QDB_PATH,
+    'dbRealpath'    => realpath(QDB_PATH) ?: null,
+    'dbBytes'       => is_file(QDB_PATH) ? filesize(QDB_PATH) : 0,
+    'dbOpenOk'      => $dbOpenOk,
+    'dbError'       => $dbError,
+    'expectedKeySha'=> 'e584e16eb81fbb4f1e3aac965b5225c5fefabc2a67ea20e26e55671c7d9f1ae7',
+]);