Spring Boot startup time: bean-by-bean diagnosis, and one directory per post

Adds spring-boot-startup-time/, the companion project for BLOG-618: a runnable
Spring Boot 4.1.1 application on JDK 25 that installs BufferingApplicationStartup
and FlightRecorderApplicationStartup behind a system property, and a /diag/startup
endpoint that computes step self time -- the number /actuator/startup does not give
you and the one that names the actual culprits.

Captured under docs/output/: the step tree sorted both ways, the same startup as JFR
events, a +5000-class experiment putting 0.11 ms per scanned class on the classpath
scan tax, the silent truncation a 2048-step buffer performs, and JDK 25 AOT cache
timings (6.93 s to 4.82 s). Post body and metadata live in post/.

Moves the existing Actuator project into actuator-in-production/ so the repository
holds one directory per article; the root README is now an index.

actuator-in-production/docs/output/06-management-port.txt

@@ -0,0 +1,101 @@
+### profile: mgmtport
+### management.server.port: 9001 / management.server.address: 127.0.0.1 / base-path: /manage
+
+--- the application port no longer serves Actuator at all ---
+  GET :8080/actuator/health                            401
+  GET :8080/manage/health                              401
+  GET :8080/orders/count                               200
+
+--- the management port serves it on the new base path ---
+  GET :9001/manage/health                              503
+  GET :9001/actuator/health                            404
+  GET :9001/orders/count                               404
+
+  Note the last line. The management context has its own DispatcherServlet and does NOT
+  see application controllers. That is the isolation you are paying for.
+
+--- what the management context reports about itself ---
+$ curl -s -u ops:ops-password http://127.0.0.1:9001/manage/diag
+{
+    "activeProfiles": [
+        "mgmtport"
+    ],
+    "serverPort": "8080",
+    "managementPort": "9001",
+    "managementBasePath": "/manage",
+    "exposureInclude": "*",
+    "exposureExclude": "(none)",
+    "healthShowDetails": "never",
+    "exposedWebEndpointCount": 14,
+    "exposedWebEndpoints": {
+        "beans": [
+            "GET beans"
+        ],
+        "conditions": [
+            "GET conditions"
+        ],
+        "configprops": [
+            "GET configprops",
+            "GET configprops/{prefix}"
+        ],
+        "diag": [
+            "GET diag"
+        ],
+        "env": [
+            "GET env",
+            "GET env/{toMatch}"
+        ],
+        "health": [
+            "GET health",
+            "GET health/{*path}"
+        ],
+        "info": [
+            "GET info"
+        ],
+        "loggers": [
+            "GET loggers",
+            "GET loggers/{name}",
+            "POST loggers/{name}"
+        ],
+        "mappings": [
+            "GET mappings"
+        ],
+        "metrics": [
+            "GET metrics",
+            "GET metrics/{requiredMetricName}"
+        ],
+        "prometheus": [
+            "GET prometheus"
+        ],
+        "sbom": [
+            "GET sbom",
+            "GET sbom/{id}"
+        ],
+        "scheduledtasks": [
+            "GET scheduledtasks"
+        ],
+        "threaddump": [
+            "GET threaddump",
+            "GET threaddump"
+        ]
+    },
+    "healthContributors": [
+        "db  (DataSourceHealthIndicator)",
+        "diskSpace  (DiskSpaceHealthIndicator)",
+        "externalApi  (ExternalApiHealthIndicator)",
+        "kafka  (KafkaHealthIndicator)",
+        "livenessState  (LivenessStateHealthIndicator)",
+        "ordersDatabase  (OrdersDatabaseHealthIndicator)",
+        "ping  (PingHealthIndicator)",
+        "readinessState  (ReadinessStateHealthIndicator)",
+        "ssl  (SslHealthIndicator)"
+    ]
+}
+
+--- listening sockets ---
+$ ss -ltn | grep -E ':(8080|9001)'
+LISTEN 0      100                     *:8080            *:*          
+LISTEN 0      100    [::ffff:127.0.0.1]:9001            *:*          
+
+  9001 is bound to 127.0.0.1 only. 8080 is bound to *. An ingress that forwards to 8080
+  cannot reach Actuator no matter how the security rules are written.