fix(security): close the Steam test endpoint, /internal and Prometheus to the public

/api/steam/test/{steamId} let anyone query any Steam profile with our API key. /internal/** had no controller but was open for any future one. Actuator now exposes only health, without details. The management block was also indented under endpoints, so show-details never applied.

src/main/resources/application.yml

@@ -26,14 +26,10 @@ management:
   endpoints:
     web:
       exposure:
-        include: health, prometheus, metrics
-    endpoint:
-      health:
-        show-details: always
-    prometheus:
-      metrics:
-        export:
-          enabled: true
+        include: health
+  endpoint:
+    health:
+      show-details: never
 security:
   jwt:
     public-key: ${JWT_PUBLIC_KEY}