fix(gateway): localhost exempt from HTTPS redirect; magatama-infra-health routing

- tls-config.ts: skip HTTP→HTTPS redirect for localhost/127.0.0.1 callers
  so internal services (infra-health, fix-engine) can call via plain HTTP
- routing-rules.yaml: add magatama-infra-health + infra-health to
  ctx_health_diagnose allowed callers; add qwen2.5:3b to fallback chain

packages/gateway/src/config/routing-rules.yaml

@@ -1318,8 +1318,8 @@ routing_rules:
     output_format: json
     requires_fact_check: false
     validators: [schema, length]
-    callers: [ctx-health, internal]
+    callers: [ctx-health, magatama-infra-health, infra-health, internal]
-    fallback_chain: [ctxhealer:latest, qwen2.5:14b]
+    fallback_chain: [ctxhealer:latest, qwen2.5:14b, qwen2.5:3b]
 
   ctx_health_alert:
     model: qwen2.5:14b

packages/gateway/src/security/tls-config.ts

@@ -107,6 +107,12 @@ export async function registerHTTPSRedirectMiddleware(server: FastifyInstance) {
       return;
     }
 
+    // Skip for localhost/loopback callers (infra-health, fix-engine, internal services)
+    const reqHost = String(request.headers['host'] ?? '');
+    if (reqHost.startsWith('localhost') || reqHost.startsWith('127.0.0.1')) {
+      return;
+    }
+
     // Check if connection is not secure
     // In production, X-Forwarded-Proto is set by reverse proxy (Cloudflare)
     const isSecure =
@@ -126,11 +132,14 @@ export async function registerHTTPSRedirectMiddleware(server: FastifyInstance) {
  */
 export async function registerSecurityHeadersMiddleware(server: FastifyInstance) {
   server.addHook('onSend', async (request, reply) => {
-    // Content Security Policy for the self-contained dashboard UI.
+    // Content Security Policy — route handlers may set a narrower CSP before this hook.
+    // Default allows 'unsafe-inline' for the dashboard UI.
+    if (!reply.getHeader('Content-Security-Policy')) {
       reply.header(
         'Content-Security-Policy',
         "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
       );
+    }
 
     // Prevent clickjacking
     reply.header('X-Frame-Options', 'DENY');