Composed health

GET /api/bng/health                                    read_only

This is the endpoint an NMS polls for up/down and capacity alarming. It merges
the controller's own health document with QuantumTouch's reply-path state, which
the controller cannot compute because it does not observe the wire.

{
  "status": "ok",
  "vpp":    { "connected": true },
  "radius": { "auth": { "reachable": true }, "acct": { "reachable": true } },
  "sessions": {
    "connected": 8102, "captive": 274, "offering": 45, "total": 8421,
    "onboard_refused": 0, "max": 100000, "at_cap": false
  },
  "pools": {
    "subs-pool": { "utilization": 0.5140, "alloc_failures": "0", "pressure": "ok" }
  },
  "persistence": {
    "save_ms":            { "last": 6, "max": 41 },
    "write_lock_wait_ms": { "last": 0, "max": 12 }
  },
  "reply_path": { "rx_pps": 41822.55, "tx_pps": 41790.10, "ratio": 0.9992, "stall_samples": 0 }
}

The status field rolls up to ok, degraded, or fault. The rule is
deliberate: fault when VPP is disconnected or both RADIUS endpoints are
unreachable; degraded when exactly one RADIUS endpoint is unreachable; and
pool pressure is reported but does not gate the verdict — a deliberately full
pool is an operational condition to act on, not a service outage.

The sessions block carries the capacity-edge signals. onboard_refused is a
monotonic count of onboards the data plane rejected, which climbs once a capped
box is full. max and at_cap report the compiled session cap and whether the
node is currently refusing new sessions; when VPP is down the cap is unknowable
and both fields are omitted rather than guessed. The persistence gauges
expose the controller's own write-path timing and are the early-warning signal
for the database-bound write ceiling that ultimately bounds sessions per node.

reply_path is QuantumTouch's contribution and is described in Architecture
above. It is present on every response.

Failure behaviour is the point of this endpoint. If the controller is
unreachable, the call returns 502 — but the body is still a well-formed health
document, with status: "fault", zeroed session counts, an error object
carrying CONTROLLER_UNREACHABLE, and the live reply_path block. A
monitoring system therefore always receives a parseable verdict rather than a
connection error, and can distinguish "the BNG is down" from "the management
plane is down".