fix(e2e): probe /handshake for readiness instead of removed /servers

[roziscoding]

Summary

The e2e readiness wait in .mise/tasks/test/e2e polled GET /servers, which was removed from the peer-facing app in the security hardening. curl -sf looped on the 404 until the 60s timeout fired (exit 124), failing the e2e job even though both Jack instances were up and healthy.

Switches the probe to the authenticated /handshake endpoint (still present on the peer-facing app), keeping the existing API-key header.

Notes

• Test-harness only — no product/runtime change. The unit test job and the shipped image are unaffected; this just unblocks the e2e job.
• The Docker healthcheck was already moved to /ping in the security change; this is the separate task-script probe.

Greptile Summary

This PR fixes the e2e readiness check after the peer-facing route changes. The main changes are:

• Probes /handshake instead of the removed /servers route in the e2e task.
• Keeps the API key header on both Jack readiness checks.
• Updates the Torznab invalid-key test to expect an opaque unauthorized XML response.
• Removes the root Cursor rule symlink.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

_{Reviews (3): Last reviewed commit: "chore: remove .cursor editor rules" | Re-trigger Greptile}

Context used (5)

• Context used - packages/schemas/CLAUDE.md (source)
• Context used - CLAUDE.md (source)
• Context used - Use Bun instead of Node.js, npm, pnpm, or vite. (source)
• Context used - apps/backend/CLAUDE.md (source)
• Context used - AGENTS.md (source)