Expose health and Prometheus metrics via Spring Boot Actuator

[jzonthemtn]

Arbiter has no health endpoint and no metrics. There is no spring-boot-starter-actuator dependency in any of its three modules (arbiter-domain, arbiter-platform, arbiter-webapp), so nothing outside the application can distinguish "serving its login page" from "healthy".

This surfaced while building the Philterd Appliance console, which shows a status tile per product. Arbiter's tile reports "running" purely because its root path answers, even when its MongoDB or OpenSearch connection is broken.

Philter 4.0 already made this change and is a direct reference: management.endpoints.web.exposure.include=health,prometheus in application.properties, plus /actuator/** in the permitAll() matcher list in SecurityConfig.

Health and metrics endpoints are needed by anyone running Arbiter in production, not only by the appliance.

Acceptance Criteria

• spring-boot-starter-actuator is a dependency of arbiter-webapp
• /actuator/health returns 200 with {"status":"UP"} when the application is serving
• /actuator/health reports DOWN when MongoDB is unreachable
• /actuator/health reports DOWN when OpenSearch is unreachable
• /actuator/prometheus returns metrics in Prometheus text format
• Only health and prometheus are exposed; no other actuator endpoint is reachable
• Both endpoints are reachable without authentication, matching Philter 4.0
• Both endpoints are documented, including the fact that they are unauthenticated

[jzonthemtn]

Tracked in philterd/philterd-appliance#2 alongside the other health and metrics gaps found while building the appliance.