feat: redis health, prod JWT guard, locale selector fix, nested card flatten

[chigozirim007]

Summary

Four assigned issues, one PR per repo per persona.

• closes [Backend] Add health-check status for Redis connectivity #428 — /health now includes a Redis PING probe via a new check_redis_health() helper. Returns {status, detail?}; never raises, so a downed Redis surfaces as degraded instead of a 500. Three backend tests cover not-initialised / healthy / exception, plus an end-to-end assertion that the field is present in the response shape.
• closes [Backend] Validate production JWT secret on startup #430 — Settings gained a model_validator (mode="after") that refuses to construct when debug=False and jwt_secret_key is still the bundled default. The error message names JWT_SECRET_KEY and points operators at setting it to a unique value. Local debug mode keeps the convenient default. Three tests pin the behaviour (production-rejects-default, production-accepts-custom, debug-keeps-default).
• closes [Frontend UX] Improve language selector route handling for default locale #422 — Navbar's language selector previously read pathname.split("/")[0] directly, so routes like /dashboard/orders rendered an out-of-set value ("dashboard") in the <select>. Now it goes through getLocaleFromPathname (validates against SUPPORTED_LOCALES, falls back to DEFAULT_LOCALE) for the current-value read and buildLocalizedPath for the route swap on change. New __tests__/i18nConfig.test.ts covers all three helpers including the near-miss case (/english/about falls back to default).
• closes [Frontend UX] Normalize card radius and nested card usage #419 — flattened the nested "Actions" panel inside the htlcs detail Card (variant="glass"). It was a rounded-2xl border border-border bg-surface-raised second-card surface inside the parent Card — exactly the "card inside a card" pattern the issue calls out. Now uses a subtle bg-surface-raised/60 tint with the smaller rounded-xl radius, with an inline comment recording the radius-normalisation decision.

Notes

• I could not run pytest / vitest locally in the build sandbox; CI is the source of truth. Both new test files follow the patterns of existing tests in backend/tests/ and frontend/src/__tests__/.
• The radius change is intentionally scoped to a single page (the issue asks for one high-traffic page first); other pages with raw rounded-2xl divs are left for a follow-up so this PR stays narrow.

Test plan

• CI: pytest backend/tests/test_health_and_jwt_validation.py passes (7 tests)
• CI: vitest frontend/src/__tests__/i18nConfig.test.ts passes (14 cases)
• Manual: hit /health with Redis down — response is 200 with redis.status: "degraded"
• Manual: launch with DEBUG=false and the default secret — startup errors with the named env var
• Manual: visit /dashboard/orders — language selector shows EN (or the default), changing it routes to /es/dashboard/orders

[drips-wave]

@chigozirim007 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits