fix(security): hide health details and close Prometheus to the public

/actuator/health showed database and disk details to anyone, and /actuator/prometheus was open. Only health stays public, as plain UP/DOWN for the Docker health check.

src/main/resources/application.yml

@@ -31,15 +31,10 @@ management:
   endpoints:
     web:
       exposure:
-        # Expose health and metrics to the web
-        include: health, prometheus, metrics
+        include: health
   endpoint:
     health:
-      show-details: always
-  prometheus:
-    metrics:
-      export:
-        enabled: true
+      show-details: never
 
 # Security stuff
 security: