refactor: modularize backend security and observability

backend/routes/system.routes.js

@@ -0,0 +1,35 @@
+const express = require('express');
+
+function createSystemRouter({ SettingsDB, healthService }) {
+  const router = express.Router();
+
+  router.get('/health', (req, res) => {
+    const result = healthService.check();
+    res.status(result.healthy ? 200 : 503).json({
+      success: result.healthy,
+      status: result.status,
+      uptimeSeconds: Math.floor(process.uptime()),
+      timestamp: new Date().toISOString(),
+      requestId: req.id,
+      checks: result.checks
+    });
+  });
+
+  router.get('/config', (req, res) => {
+    const maxUploadSize = parseInt(SettingsDB.get('max_upload_size') || '10737418240', 10);
+    res.json({ success: true, config: { max_upload_size: maxUploadSize } });
+  });
+
+  router.get('/public/theme', (req, res) => {
+    try {
+      const globalTheme = SettingsDB.get('global_theme') || 'dark';
+      res.json({ success: true, theme: globalTheme });
+    } catch {
+      res.json({ success: true, theme: 'dark' });
+    }
+  });
+
+  return router;
+}
+
+module.exports = { createSystemRouter };