fix(obs): wire Prometheus endpoint for Spring Boot 4.0

Four Spring Boot 4.0-specific issues prevented /actuator/prometheus from working:

1. spring-boot-starter-micrometer-metrics missing — Spring Boot 4.0 splits
   Micrometer metrics export (including the Prometheus scrape endpoint) out of
   spring-boot-starter-actuator into its own starter. Added dependency.

2. management.prometheus.metrics.export.enabled not set — Spring Boot 4.0
   defaults metrics export to false (opt-in). Added the property to
   application.yaml.

3. SecurityConfig did not permit /actuator/prometheus — Spring Boot 4.0
   with Jetty serves the management port (8081) via the same security filter
   chain as the main port (8080). The previous commit's exclusion of
   ManagementWebSecurityAutoConfiguration was a no-op (that class no longer
   exists in Spring Boot 4.0); removed it and added the correct permitAll()
   rule. Updated the architecture comment in application.yaml to reflect the
   true filter-chain behaviour.

4. Reverted invalid FamilienarchivApplication.java change from the prior
   commit (ManagementWebSecurityAutoConfiguration import compiled against a
   class that does not exist in the Spring Boot 4.0 BOM).

Also adds ActuatorPrometheusIT — an integration test that asserts the
/actuator/prometheus endpoint returns 200 with jvm_memory_used_bytes without
credentials, serving as regression protection against future Spring Boot
upgrades silently breaking metrics collection.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/main/resources/application.yaml

@@ -49,7 +49,8 @@ management:
     # Management port is separate from the app port so that:
     # (a) Caddy never proxies /actuator/* (it only routes :8080 → the app port)
     # (b) Prometheus scrapes backend:8081 directly inside archiv-net, not via Caddy
-    # (c) Spring Security's session-authenticated filter chain on :8080 never sees actuator requests
+    # Note: in Spring Boot 4.0 the management port shares the security filter chain; /actuator/health
+    # and /actuator/prometheus must be explicitly permitted in SecurityConfig — see SecurityConfig.java.
     port: 8081
   endpoints:
     web:
@@ -58,6 +59,11 @@ management:
   endpoint:
     prometheus:
       enabled: true
+  # Spring Boot 4.0: metrics export is disabled by default — explicitly opt in for Prometheus
+  prometheus:
+    metrics:
+      export:
+        enabled: true
   health:
     mail:
       enabled: false