S15: sm-leaf health HTTP, verae.sm.* acks, systemd unit

Loopback GET /health, nats-leaf:// rewrite, subject request-reply tests.
Do not replace pfc-py-admin. NpeRequired stays on the package surface.

python/secure_messaging/__init__.py

@@ -3,6 +3,7 @@ from .signed_config import SignedConfig, UnsignedConfig  # signed wrapper load/s
 from .envelope import PassthroughEnvelope  # dest-in-clear, body ciphertext
 from .error_bundle import NetworkErrorBundle  # system-key + sender-only
 from .admin_history import AdminHistory  # DataCube-shaped append-only config log
+from .npe_adapter import NpeRequired  # fail-closed NPE
 
 __all__ = [
     "SignedConfig",
@@ -10,4 +11,5 @@ __all__ = [
     "PassthroughEnvelope",
     "NetworkErrorBundle",
     "AdminHistory",
+    "NpeRequired",
 ]