feat(P05): health check daemon with /healthz, /readyz, /v1/* handlers

- internal/daemon/server.go: HTTP Server with lifecycle, logging middleware
- internal/daemon/health.go: /healthz (liveness), /readyz (db+ready), /v1/status
- internal/daemon/jobs_handler.go: GET /v1/jobs, /v1/jobs/{id}, /v1/jobs/{id}/tasks
- internal/daemon/nodes_handler.go: GET /v1/nodes
- internal/daemon/tasks_handler.go: GET /v1/tasks (with ?job_id and ?limit)
- internal/daemon/validate.go: input validation for path IDs
- internal/daemon/version.go: ldflags-friendly version var
- internal/store: added TaskRepo.ListRecent for unfiltered task listing
- internal/cli/daemon.go: CLI wiring with signal.NotifyContext shutdown

Personas: backend-engineer (handlers), cli-engineer (CLI wiring),
security-engineer (input validation, no secrets in access logs, slog JSON).

---ci---
project: orca
phase: 5
milestone: v0.1
status: execute
requirements:
  covered: [REQ-006, REQ-017, REQ-019]
  partial: []
---/ci---

internal/cli/daemon.go

@@ -0,0 +1,76 @@
+package cli
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"git.cloudinit.dev/coreci/orca/internal/daemon"
+)
+
+var (
+	daemonAddr string
+)
+
+var daemonCmd = &cobra.Command{
+	Use:   "daemon",
+	Short: "Run the orca daemon (HTTP API + health checks)",
+	Long:  "Start the orca daemon. Listens on the configured address for health and API requests.",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		db, closer, err := openDB()
+		if err != nil {
+			return err
+		}
+		defer closer()
+
+		srv := daemon.NewServer(daemon.Options{
+			DB:    db,
+			Log:   newLogger(),
+			Addr:  daemonAddr,
+			Actor: "daemon",
+		})
+		srv.MarkReady()
+
+		errCh := make(chan error, 1)
+		go func() {
+			err := srv.Start()
+			if err != nil && !errors.Is(err, http.ErrServerClosed) {
+				errCh <- err
+			}
+		}()
+
+		fmt.Fprintf(cmd.OutOrStdout(), "✓ orca daemon listening on %s\n", daemonAddr)
+		fmt.Fprintln(cmd.OutOrStdout(), "  /healthz    - liveness")
+		fmt.Fprintln(cmd.OutOrStdout(), "  /readyz     - readiness (db + ready flag)")
+		fmt.Fprintln(cmd.OutOrStdout(), "  /v1/status  - status JSON")
+		fmt.Fprintln(cmd.OutOrStdout(), "  /v1/jobs    - list jobs")
+		fmt.Fprintln(cmd.OutOrStdout(), "  /v1/nodes   - list nodes")
+		fmt.Fprintln(cmd.OutOrStdout(), "  /v1/tasks   - list tasks")
+		fmt.Fprintln(cmd.OutOrStdout(), "  press Ctrl+C to stop")
+
+		ctx, stop := signal.NotifyContext(cmd.Context(), os.Interrupt, syscall.SIGTERM)
+		defer stop()
+
+		select {
+		case <-ctx.Done():
+			fmt.Fprintln(cmd.OutOrStdout(), "\nshutting down...")
+			shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+			return srv.Shutdown(shutdownCtx)
+		case err := <-errCh:
+			return err
+		}
+	},
+}
+
+func init() {
+	daemonCmd.Flags().StringVar(&daemonAddr, "addr", ":8080", "listen address")
+	rootCmd.AddCommand(daemonCmd)
+}