fix(security): close the Steam test endpoint, /internal and Prometheus to the public

/api/steam/test/{steamId} let anyone query any Steam profile with our API key. /internal/** had no controller but was open for any future one. Actuator now exposes only health, without details. The management block was also indented under endpoints, so show-details never applied.

src/test/java/core_service/configuration/security/PublicEndpointsTest.java

@@ -0,0 +1,64 @@
+package core_service.configuration.security;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.testcontainers.service.connection.ServiceConnection;
+import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
+import org.springframework.test.context.DynamicPropertyRegistry;
+import org.springframework.test.context.DynamicPropertySource;
+import org.springframework.test.web.servlet.MockMvc;
+import org.testcontainers.containers.PostgreSQLContainer;
+import org.testcontainers.junit.jupiter.Container;
+import org.testcontainers.junit.jupiter.Testcontainers;
+
+import java.security.KeyPairGenerator;
+import java.util.Base64;
+import java.util.Set;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+/**
+ * Runs with the production security filter (not the dev profile, which injects a dummy user).
+ */
+@Tag("IntegrationTest")
+@SpringBootTest
+@AutoConfigureMockMvc
+@Testcontainers
+class PublicEndpointsTest {
+
+    @Container
+    @ServiceConnection
+    static PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("postgres:17-alpine");
+
+    @DynamicPropertySource
+    static void properties(DynamicPropertyRegistry registry) throws Exception {
+        byte[] publicKey = KeyPairGenerator.getInstance("Ed25519").generateKeyPair().getPublic().getEncoded();
+        registry.add("security.jwt.public-key", () -> Base64.getEncoder().encodeToString(publicKey));
+        registry.add("app.steam.api-key", () -> "test-key");
+    }
+
+    @Autowired
+    private MockMvc mockMvc;
+
+    @Test
+    void healthIsPublicWithoutDetails() throws Exception {
+        mockMvc.perform(get("/actuator/health"))
+                .andExpect(status().isOk())
+                .andExpect(jsonPath("$.status").value("UP"))
+                .andExpect(jsonPath("$.components").doesNotExist());
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {"/actuator/prometheus", "/api/steam/test/76561198000000001", "/internal/anything"})
+    void endpointIsNotPublic(String path) throws Exception {
+        int status = mockMvc.perform(get(path)).andReturn().getResponse().getStatus();
+        assertTrue(Set.of(401, 403).contains(status), path + " answered " + status);
+    }
+}