Add comprehensive test coverage for server/ package

Cover edge cases: statusWriter multi-call/default/unwrap, UUID v4 format
and uniqueness, non-string panics, recovery body and log attributes,
4xx log level, default status in logging, request ID propagation,
server defaults/options/listen-error/multiple-hooks/logger, router
groups with empty prefix/inherited middleware/ordering/path params/
isolation, mount trailing slash, health content-type and POST rejection.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/health_test.go

@@ -88,3 +88,79 @@ func TestHealthHandler(t *testing.T) {
 		}
 	})
 }
+
+func TestHealth_MultipleFailingCheckers(t *testing.T) {
+	h := server.HealthHandler(
+		func() error { return errors.New("db down") },
+		func() error { return errors.New("cache down") },
+	)
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/readyz", nil)
+	h.ServeHTTP(w, req)
+
+	if w.Code != http.StatusServiceUnavailable {
+		t.Fatalf("got status %d, want %d", w.Code, http.StatusServiceUnavailable)
+	}
+
+	var resp map[string]any
+	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
+		t.Fatalf("decode failed: %v", err)
+	}
+
+	errs, ok := resp["errors"].([]any)
+	if !ok || len(errs) != 2 {
+		t.Fatalf("expected 2 errors, got %v", resp["errors"])
+	}
+
+	errStrs := make(map[string]bool)
+	for _, e := range errs {
+		errStrs[e.(string)] = true
+	}
+	if !errStrs["db down"] || !errStrs["cache down"] {
+		t.Fatalf("expected 'db down' and 'cache down', got %v", errs)
+	}
+}
+
+func TestHealth_LivenessContentType(t *testing.T) {
+	h := server.HealthHandler()
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/healthz", nil)
+	h.ServeHTTP(w, req)
+
+	ct := w.Header().Get("Content-Type")
+	if ct != "application/json" {
+		t.Fatalf("got Content-Type %q, want %q", ct, "application/json")
+	}
+}
+
+func TestHealth_ReadinessContentType(t *testing.T) {
+	h := server.HealthHandler()
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/readyz", nil)
+	h.ServeHTTP(w, req)
+
+	ct := w.Header().Get("Content-Type")
+	if ct != "application/json" {
+		t.Fatalf("got Content-Type %q, want %q", ct, "application/json")
+	}
+}
+
+func TestHealth_PostMethodNotAllowed(t *testing.T) {
+	h := server.HealthHandler()
+
+	for _, path := range []string{"/healthz", "/readyz"} {
+		t.Run("POST "+path, func(t *testing.T) {
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest(http.MethodPost, path, nil)
+			h.ServeHTTP(w, req)
+
+			// ServeMux with "GET /healthz" pattern should reject POST.
+			if w.Code == http.StatusOK {
+				t.Fatalf("POST %s should not return 200, got %d", path, w.Code)
+			}
+		})
+	}
+}