docs: replace stale GET /health references with /livez and /admin/v1/health

docs/configuration/admin-api.md

@@ -28,7 +28,7 @@ Admin authentication is static and bootstrap-based for the authenticated operato
 
 The following routes are currently public on the admin listener:
 
-- `GET /health`
+- `GET /livez`
 - `GET /metrics`
 - `GET /admin/openapi.json`
 - `GET /admin/openapi-scalar`
@@ -51,7 +51,7 @@ Do not mix them.
 
 The current admin router exposes:
 
-- `GET /health`
+- `GET /livez`
 - `GET /metrics`
 - `GET /admin/openapi.json`
 - `GET /admin/openapi-scalar`
@@ -97,9 +97,9 @@ Current status behavior includes:
 - `409` for conflicts such as duplicate names
 - `500` for store failures
 
-Public routes such as `/health`, `/metrics`, and the OpenAPI endpoints do not require admin auth.
+Public routes such as `/livez`, `/metrics`, and the OpenAPI endpoints do not require admin auth.
 
-Use `GET /health` for simple admin-listener reachability. Use `GET /admin/v1/health` when you need authenticated per-model operator health.
+Use `GET /livez` for simple admin-listener reachability. Use `GET /admin/v1/health` when you need authenticated per-model operator health.
 
 For automation, plan to branch on admin status codes and `error_msg`, not on the proxy-side OpenAI-compatible error envelope.
 

docs/configuration/bootstrap-config.md

@@ -207,13 +207,13 @@ This is a deployment concern, not a per-guardrail-row field.
 After updating the bootstrap config, start the gateway and verify:
 
 ```bash title="Verify proxy bootstrap"
-curl -s http://127.0.0.1:3000/health
+curl -s http://127.0.0.1:3000/livez
 ```
 
 For standalone mode, also verify:
 
 ```bash title="Verify admin bootstrap"
-curl -s http://127.0.0.1:3001/health
+curl -s http://127.0.0.1:3001/livez
 ```
 
 ## Troubleshooting

docs/operations/network-and-security.md

@@ -20,7 +20,7 @@ Recommended boundary:
 
 Do not assume admin auth alone is enough protection. Current admin design intentionally leaves some routes unauthenticated on that private listener.
 
-Current admin design intentionally leaves `/health`, `/metrics`, and OpenAPI endpoints unauthenticated on that private listener, so network placement matters.
+Current admin design intentionally leaves `/livez`, `/metrics`, and OpenAPI endpoints unauthenticated on that private listener, so network placement matters.
 
 ## Secrets And Credentials
 

docs/operations/production-deployment.md

@@ -85,8 +85,8 @@ Before routing real traffic, verify:
 
 After deployment, confirm:
 
-1. `GET /health` returns `200`
-2. admin-listener `GET /health` returns `200` in standalone mode
+1. `GET /livez` returns `200`
+2. admin-listener `GET /livez` returns `200` in standalone mode
 3. `GET /admin/v1/health` returns `200` in standalone mode
 4. `GET /v1/models` returns the expected caller-visible aliases for a test key
 5. one real request succeeds on each endpoint family you actually use

docs/operations/troubleshooting.md

@@ -91,8 +91,8 @@ Meaning:
 
 When you are not sure where to start:
 
-1. check `GET /health`
-2. check admin-listener `GET /health`, then `GET /admin/v1/health` in standalone mode
+1. check `GET /livez`
+2. check admin-listener `GET /livez`, then `GET /admin/v1/health` in standalone mode
 3. identify whether the symptom is startup, propagation, upstream, or policy related
 4. inspect the most specific signal next: logs, metrics, headers, or admin health freshness
 

docs/operations/upgrades-and-compatibility.md

@@ -18,8 +18,8 @@ Treat upgrades as behavior changes to be verified, not just binary replacements.
 
 Before and after an upgrade, verify:
 
-1. `GET /health`
-2. admin-listener `GET /health`
+1. `GET /livez`
+2. admin-listener `GET /livez`
 3. `GET /admin/v1/health`
 4. `GET /v1/models`
 5. one real request on each critical endpoint your clients use

docs/reference/admin-api-reference.md

@@ -6,7 +6,7 @@ sidebar_position: 61
 
 ## Public Admin-Listener Routes
 
-- `GET /health`
+- `GET /livez`
 - `GET /metrics`
 - `GET /admin/openapi.json`
 - `GET /admin/openapi-scalar`