[Task] Publishing Environments: compact endpoint status (ping) API #38027

Description

The Publishing Environments modal (#37813) shows a Status column for each endpoint in an environment. Today the only way to learn anything about a receiver is the integrity check, which is far too heavy to run every time the modal opens: it asks the receiver to export all of its folders, sites, content types, HTML pages, file assets and roles to CSV (IntegrityResource#generateIntegrityCheckerRequest → remote /api/integrity/_generateintegritydata), keeps progress in the caller's HTTP session, and stores conflicts when it finds any.

Design and implement a compact, side-effect-free REST endpoint that returns the status of a push-publishing endpoint, so the modal can show a status for every endpoint as soon as it opens.

To settle in the design

• What "status" means — at minimum: is the receiver reachable, and does it accept the stored auth token (valid / expired / invalid — the receiver already reports invalid and expired tokens through the WWW-Authenticate error_key, see IntegrityResource#handleInvalidTokenResponse). Optionally: receiver version compatibility.
• Shape — one call per endpoint, or one call per environment returning every endpoint's status (avoids N requests when the modal opens).
• Endpoint types — Dynamic HTTP / HTTPS are the main case; define what AWS S3 and Static return (e.g. "not applicable", or a bucket / target check).
• Receiver side — whether an existing receiver endpoint can be called cheaply with the push-publish token, or a minimal authenticated "ping" has to be added on the receiver.
• Timeouts and caching — a short, configurable timeout so a down receiver doesn't stall the modal; whether a short-lived cache is worth it so reopening the modal doesn't hit every receiver again.

Acceptance Criteria

• The design (request / response shape, status values, timeout, caching) is posted on this issue and agreed with the frontend work in [Task] Publishing Environments: Angular modal in Publishing Queue + backend wiring #37815 before implementation starts.
• For a Dynamic HTTP / HTTPS endpoint the response says whether the receiver is reachable and whether the stored token is valid, expired or invalid, with a human-readable message.
• AWS S3 and Static endpoints get a defined, documented response.
• No side effects on either server: no integrity data generated, nothing persisted, no HTTP-session state.
• A receiver that is down or slow is reported within a bounded, configurable time (Config property) instead of blocking the caller.
• Access matches the rest of the modal: CMS Admins and users with the Configuration portlet only (see Access by user level on Dojo to Angular: Publishing Environments modal in Publishing Queue #37813); everyone else gets 403.
• The auth token is never returned in the response or written to logs.
• Typed REST resource with @Schema matching the actual return type; openapi.yaml regenerated and committed.
• Integration tests cover reachable, unreachable, invalid / expired token, and forbidden user; Postman collection updated.

Priority

Medium

Additional Context

• Feeds the Status column of the endpoints table in the Publishing Environments modal (Dojo to Angular: Publishing Environments modal in Publishing Queue #37813, implementation in [Task] Publishing Environments: Angular modal in Publishing Queue + backend wiring #37815). The modal depends on this endpoint for that column; integrity checks are never run automatically to fill it.
• Related server-side access gaps for the integrity and endpoint-listing operations are listed on Dojo to Angular: Publishing Environments modal in Publishing Queue #37813 → Known server-side access gaps.