fix: use GATEWAY_TOKEN as Jupyter token fallback when JUPYTER_TOKEN unset

health-server.js starts before start_jupyter_once() runs, so
process.env.JUPYTER_TOKEN is empty in Node. Mirror start.sh fallback:
if JUPYTER_TOKEN is unset or "huggingface", use GATEWAY_TOKEN instead —
that's what Jupyter is started with, so the injected header now matches.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

health-server.js

@@ -632,7 +632,10 @@ const server = http.createServer(async (req, res) => {
     }
     if (!requireAuth(req, res)) return;
     // Inject the Jupyter token so JupyterLab skips its own login screen.
-    const jToken = (process.env.JUPYTER_TOKEN || "").trim();
+    // Mirror start.sh logic: JUPYTER_TOKEN falls back to GATEWAY_TOKEN when
+    // unset or still the insecure default — that's what Jupyter was started with.
+    const rawJupyterToken = (process.env.JUPYTER_TOKEN || "").trim();
+    const jToken = (!rawJupyterToken || rawJupyterToken === "huggingface") ? GATEWAY_TOKEN : rawJupyterToken;
     return proxyHTTP(req, res, JUPYTER_HOST, JUPYTER_PORT, {
       publicPrefix: JUPYTER_BASE,
       // Jupyter is started with --ServerApp.base_url=/terminal/, so keep the