[umpireboulianne-design]

Summary

• Explicitly reject non-GET HTTP methods (POST, PUT, PATCH, DELETE, HEAD, OPTIONS) at the top of createStatusHandler in services/keeper/src/status-server.ts with HTTP 405 Method Not Allowed, an Allow: GET response header, and a structured JSON error body ({ error: "method not allowed", method, allow: ["GET"], available }).
• Extend send() in services/keeper/src/status-server.ts to accept optional extra headers alongside content-type: application/json and cache-control: no-store.
• Add unit and real http.Server boundary tests in services/keeper/src/status-server.test.ts covering GET routes as well as POST, PUT, PATCH, DELETE, HEAD, and OPTIONS requests across /, /status, /status/rounds/:id, /status/health, and /healthz.
• Document the GET-only HTTP method policy (405 Method Not Allowed + Allow: GET) in services/keeper/README.md.

Supply-chain review

• No package scripts or dependencies changed. If changed, explain why below.
• No .vscode/, workflow, or other editor/config file changes. If changed, list them below.
• No lockfile changes. If changed, explain the update below.
• No binary or font asset changes. If changed, list and justify them below.
• I confirm no automatic task (such as preinstall/postinstall) was added.
• I confirm no hidden executable payload (encoded blob, obfuscated command, or unexpected binary) was added.
• Any changed executable or binary was reviewed by a maintainer.

Testing

• node --import tsx --test src/status-server.test.ts in services/keeper (13/13 tests pass, including rejects non-GET methods with 405 and Allow: GET at the server boundary)
• node scripts/check-direct-time-access.mjs (passes)
• node scripts/check-links.js (passes)

Closes #543
Fixes #543