S15: sm-leaf health HTTP, verae.sm.* acks, systemd unit

Loopback GET /health, nats-leaf:// rewrite, subject request-reply tests.
Do not replace pfc-py-admin. NpeRequired stays on the package surface.

tests/test_sm.py

@@ -35,9 +35,10 @@ class SignedConfigTests(unittest.TestCase):
 
 class NpeAdapterTests(unittest.TestCase):
     def test_npe_mode_fail_closed(self):
-        from secure_messaging.npe_adapter import NpeRequired
+        from secure_messaging import NpeRequired
         from secure_messaging.envelope import seal
 
+        self.assertTrue(hasattr(__import__("secure_messaging"), "NpeRequired"))
         with self.assertRaises(NpeRequired):
             seal(to="npe.inbox.x", sender="alice", body={"a": 1}, mode="npe")