### profile: secured    (SecuredActuatorConfig + application-secured.yaml)
### exposure is "*" - the security chain, not the exposure list, is what protects it

ANONYMOUS
  GET /actuator/health                           503
  GET /actuator/info                             200
  GET /actuator/env                              401
  GET /actuator/beans                            401
  GET /actuator/threaddump                       401
  GET /actuator  (the links index)               401

AUTHENTICATED as ops (ROLE_ACTUATOR)
  GET /actuator/health                           503
  GET /actuator/env                              200
  GET /actuator/beans                            200
  GET /actuator/threaddump                       200

WRONG PASSWORD
  GET /actuator/env                              401

--- health body, anonymous (show-details: when-authorized) ---
{
    "groups": [
        "liveness",
        "readiness"
    ],
    "status": "DOWN"
}

--- health body, authenticated as ROLE_ACTUATOR ---
{
    "components": {
        "db": {
            "details": {
                "database": "H2",
                "validationQuery": "isValid()"
            },
            "status": "UP"
        },
        "diskSpace": {
            "details": {
                "total": 10213466112,
                "free": 3877920768,
                "threshold": 10485760,
                "path": "/tmp/work/spring-boot-demo/.",
                "exists": true
            },
            "status": "UP"
        },
        "externalApi": {
            "details": {
                "url": "http://localhost:8080/stub/upstream/ping",
                "response": "pong",
                "latencyMs": 4,
                "timeoutMs": 750
            },
            "status": "UP"
        },
        "kafka": {
            "details": {
                "bootstrap": "localhost:9092",
                "tuned": true,
                "error": "TimeoutException: Timed out waiting for a node assignment. Call: listNodes",
                "probeMs": 1500,
                "budgetMs": 1500
            },
            "status": "DOWN"
        },
        "livenessState": {
            "status": "UP"
        },
        "ordersDatabase": {
            "details": {
                "orders": 3,
                "queryMs": 0,
                "slowThresholdMs": 250
            },
            "status": "UP"
        },
        "ping": {
            "status": "UP"
        },
        "readinessState": {
            "status": "UP"
        },
        "ssl": {
            "details": {
                "expiringChains": [],
                "invalidChains": [],
                "validChains": []
            },
            "status": "UP"
        }
    },
    "groups": [
        "liveness",
        "readiness"
    ],
    "status": "DOWN"
}

  Same endpoint, same status code, different body. An anonymous prober learns that the
  service is unhealthy but not WHICH dependency is unhealthy.

--- the business endpoint is untouched by the actuator chain ---
  GET /orders/count (anonymous)                  200