fix(obs): add management security chain and split Prometheus IT tests

- Add @Order(1) managementFilterChain scoped to /actuator/** with explicit
  401 entry point, blocking all non-public actuator paths without the
  form-login redirect that the main chain uses for browser clients.
- Split single combined test into two focused assertions
  (prometheus_endpoint_returns_200_without_credentials,
   prometheus_endpoint_returns_jvm_metrics).
- Add negative regression test: actuator_metrics_requires_authentication
  verifies that /actuator/metrics returns 401 without credentials.

Addresses reviewer concerns from @sara (missing negative test, split
assertions) and @nora (dedicated management security layer).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/test/java/org/raddatz/familienarchiv/ActuatorPrometheusIT.java

@@ -27,14 +27,29 @@ class ActuatorPrometheusIT {
     S3Client s3Client;
 
     @Test
-    void prometheus_endpoint_returns_jvm_metrics_without_credentials() {
+    void prometheus_endpoint_returns_200_without_credentials() {
         ResponseEntity<String> response = noThrowTemplate().getForEntity(
                 "http://localhost:" + managementPort + "/actuator/prometheus", String.class);
 
         assertThat(response.getStatusCode().value()).isEqualTo(200);
+    }
+
+    @Test
+    void prometheus_endpoint_returns_jvm_metrics() {
+        ResponseEntity<String> response = noThrowTemplate().getForEntity(
+                "http://localhost:" + managementPort + "/actuator/prometheus", String.class);
+
         assertThat(response.getBody()).contains("jvm_memory_used_bytes");
     }
 
+    @Test
+    void actuator_metrics_requires_authentication() {
+        ResponseEntity<String> response = noThrowTemplate().getForEntity(
+                "http://localhost:" + managementPort + "/actuator/metrics", String.class);
+
+        assertThat(response.getStatusCode().value()).isEqualTo(401);
+    }
+
     private RestTemplate noThrowTemplate() {
         RestTemplate template = new RestTemplate();
         template.setErrorHandler(new DefaultResponseErrorHandler() {