fix(api): /health never serves a cached result older than 4 TTLs

Stale-while-revalidate answered the first /health after a quiet night with
the previous evening's state (seen after the collector cutover: 'Latest data
is old: 21:00' at 13:47 while data was current). _cached_swr gains max_stale;
/health uses 4 x HEALTH_CACHE_TTL_SECONDS.

tests/test_collection_disabled.py

@@ -94,3 +94,30 @@ def test_manual_trigger_is_refused_when_collection_runs_elsewhere(monkeypatch):
     with pytest.raises(HTTPException) as err:
         asyncio.run(web_api.trigger_scraping(BackgroundTasks()))
     assert err.value.status_code == 409
+
+
+def test_stale_cache_older_than_max_stale_is_recomputed(monkeypatch):
+    """/health must not answer with a result from hours ago."""
+    import asyncio
+    import threading
+    import time
+
+    from src import web_api
+
+    cache, lock, compute_lock = {}, threading.Lock(), threading.Lock()
+    cache["k"] = (time.monotonic() - 3600, "an hour old")
+
+    value, stale = asyncio.run(
+        web_api._cached_swr(
+            cache, lock, compute_lock, "k", 30, lambda: "fresh", max_stale=120
+        )
+    )
+    assert (value, stale) == ("fresh", False)
+
+    cache["k"] = (time.monotonic() - 60, "a minute old")
+    value, stale = asyncio.run(
+        web_api._cached_swr(
+            cache, lock, compute_lock, "k", 30, lambda: "fresh", max_stale=120
+        )
+    )
+    assert (value, stale) == ("a minute old", True)  # SWR within the bound