A WAF bypass exception for health checks accidentally matches the admin route prefix after a path refactor

Monitoring stays green, but a protection hole opens because the relaxed path rule now overlaps with privileged endpoints.