Close /api/health details and API docs to the public

Health: public gets only ok/error; details need X-Internal-Key. Docs/schema: admin session only.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

config/tests.py

@@ -467,6 +467,15 @@ class ApiDocsRtlShellTests(TestCase):
     دیگری نمی‌گیردش.
     """
 
+    def setUp(self):
+        from django.contrib.auth.models import User as AuthUser
+        self.client.force_login(AuthUser.objects.create_superuser('docs-admin', 'd@x.ir', 'pw'))
+
+    def test_docs_are_closed_to_anonymous_visitors(self):
+        from rest_framework.test import APIClient
+        for path in ('/api/docs/', '/api/redoc/', '/api/schema/'):
+            self.assertIn(APIClient().get(path).status_code, (401, 403), path)
+
     def test_swagger_ui_carries_the_rtl_shell(self):
         html = self.client.get('/api/docs/').content.decode()
         self.assertIn('direction: rtl', html)
@@ -490,3 +499,20 @@ class InsecureSecretKeyWarningTests(TestCase):
             self.assertIn('django-insecure', ' '.join(health._warnings()))
         with override_settings(DEBUG=False, SECRET_KEY='a-real-random-key'):
             self.assertNotIn('django-insecure', ' '.join(health._warnings()))
+
+
+class HealthIsMinimalForThePublicTests(TestCase):
+    """/api/health بی‌کلید فقط ok/error می‌دهد؛ با کلیدِ درست جزئیات."""
+
+    @override_settings(INTERNAL_SERVICE_KEY='k')
+    def test_public_sees_only_status(self):
+        body = self.client.get('/api/health').json()
+        self.assertEqual(set(body), {'status'})
+        wrong = self.client.get('/api/health', HTTP_X_INTERNAL_KEY='nope').json()
+        self.assertEqual(set(wrong), {'status'})
+        full = self.client.get('/api/health', HTTP_X_INTERNAL_KEY='k').json()
+        self.assertIn('traffic', full)
+
+    @override_settings(INTERNAL_SERVICE_KEY='')
+    def test_without_a_configured_key_nobody_gets_details(self):
+        self.assertEqual(set(self.client.get('/api/health', HTTP_X_INTERNAL_KEY='').json()), {'status'})