fix: harden health probe responses

internal/transport/httpserver/server.go

@@ -50,6 +50,9 @@ func (r *Readiness) BeginDrain() {
 func New(addr string, ready Checker, tasks ...*service.Service) *http.Server {
 	mux := http.NewServeMux()
 	write := func(w http.ResponseWriter, status int, body map[string]string) {
+		// 探针响应不能被代理或浏览器缓存，否则下线节点可能继续被路由流量。
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("X-Content-Type-Options", "nosniff")
 		w.Header().Set("Content-Type", "application/json")
 		w.WriteHeader(status)
 		_ = json.NewEncoder(w).Encode(body)
@@ -61,6 +64,8 @@ func New(addr string, ready Checker, tasks ...*service.Service) *http.Server {
 		ctx, cancel := context.WithTimeout(r.Context(), 2*time.Second)
 		defer cancel()
 		if ready == nil || ready(ctx) != nil {
+			// 给负载均衡器一个明确的短暂重试提示；真正的重试节奏仍由探针策略控制。
+			w.Header().Set("Retry-After", "1")
 			write(w, http.StatusServiceUnavailable, map[string]string{"status": "not_ready"})
 			return
 		}