/dotmgt/metrics has no servlet mapping and returns 404, breaking the metrics-monitoring compose example

Problem

/dotmgt/metrics returns a dotCMS 404 on the management port. InfrastructureManagementFilter recognises the path and calls forwardToManagementServlet, but no servlet is mapped for it, so the forward resolves to nothing.

There is no metrics servlet mapping anywhere in the repo — and origin/main has zero occurrences of one, so this has never worked rather than having regressed.

Reproduce

1. Start dotCMS with the management port enabled (8090 by default).
2. curl -i http://localhost:8090/dotmgt/metrics

Result: dotCMS 404 page.
Expected: a Prometheus-format scrape, or an explicit "metrics disabled" response.

/dotmgt/livez, /dotmgt/readyz and /dotmgt/health on the same port all respond correctly, so this is specific to the metrics path.

Impact

docker/docker-compose-examples/single-node-metrics-monitoring ships a Prometheus scrape config pointed at this endpoint. That example cannot work as documented — Prometheus scrapes a 404 indefinitely.

Acceptance criteria

1. GET /dotmgt/metrics on the management port returns the Prometheus exposition of the Micrometer registry.
2. The single-node-metrics-monitoring compose example scrapes successfully, with a non-empty target in Prometheus.
3. When metrics are disabled by configuration, the endpoint returns a deliberate response documenting that rather than a 404.
4. Authentication behaviour matches the other /dotmgt/* endpoints (see DOT_HEALTH_DETAILED_AUTHENTICATION_REQUIRED and the equivalent metrics flags).

Notes

Blocked in practice by the metrics registry never initializing (filed separately, #36995) — a mapped endpoint would expose an empty registry until that is fixed. Both are needed for the compose example to work.

Found while verifying #36803 / #36864 on a local cluster; not caused by them.

Start with InfrastructureManagementFilter and inspect the management servlet mappings plus the equivalent metrics authentication and configuration flags. Reproduce with curl against /dotmgt/metrics, then verify the docker/docker-compose-examples/single-node-metrics-monitoring scrape configuration. Done means the endpoint returns Prometheus output or a deliberate disabled response and the compose example reports a non-empty target; coordinate with #36995 for registry initialization.