sunbeam check: parallel execution, 5s timeout, external S3 check

All checks now run concurrently via ThreadPoolExecutor so total time
is bounded by the slowest single check, not their sum.

Timeout reduced from 10s to 5s per check. SeaweedFS check switched
from kubectl exec (wget not reliably available in container) to an
HTTP probe against the external S3 endpoint (https://s3.DOMAIN/) —
consistent with the "use external URLs for publicly facing services"
requirement. 403 is treated as healthy (unauthenticated S3 response).

sunbeam/tests/test_checks.py

@@ -126,24 +126,31 @@ class TestCheckOpenbao(unittest.TestCase):
 
 
 class TestCheckSeaweedfs(unittest.TestCase):
-    def test_responding_passes(self):
-        with patch("sunbeam.checks.kube_out", return_value="seaweedfs-filer-abc"):
-            with patch("sunbeam.checks.kube_exec", return_value=(0, "filer status data")):
-                from sunbeam import checks
-                r = checks.check_seaweedfs("testdomain", None)
+    def test_200_passes(self):
+        with patch("sunbeam.checks._http_get", return_value=(200, b"")):
+            from sunbeam import checks
+            r = checks.check_seaweedfs("testdomain", None)
         self.assertTrue(r.passed)
 
-    def test_no_pod_fails(self):
-        with patch("sunbeam.checks.kube_out", return_value=""):
+    def test_403_unauthenticated_passes(self):
+        # S3 returns 403 for unauthenticated requests — that means it's up.
+        with patch("sunbeam.checks._http_get", return_value=(403, b"")):
+            from sunbeam import checks
+            r = checks.check_seaweedfs("testdomain", None)
+        self.assertTrue(r.passed)
+
+    def test_502_fails(self):
+        with patch("sunbeam.checks._http_get", return_value=(502, b"")):
             from sunbeam import checks
             r = checks.check_seaweedfs("testdomain", None)
         self.assertFalse(r.passed)
 
-    def test_exec_fails(self):
-        with patch("sunbeam.checks.kube_out", return_value="seaweedfs-filer-abc"):
-            with patch("sunbeam.checks.kube_exec", return_value=(1, "")):
-                from sunbeam import checks
-                r = checks.check_seaweedfs("testdomain", None)
+    def test_connection_error_fails(self):
+        import urllib.error
+        with patch("sunbeam.checks._http_get",
+                   side_effect=urllib.error.URLError("refused")):
+            from sunbeam import checks
+            r = checks.check_seaweedfs("testdomain", None)
         self.assertFalse(r.passed)