Add Spring Boot Actuator health, readiness and info endpoints

The backend has no health or metrics endpoint at all. spring-boot-starter-actuator isn't in app/pom.xml, the Dockerfile has no HEALTHCHECK, and docker-compose.yaml starts the app without waiting for anything. Since #209 we deploy to staging and production automatically, but nothing can tell us whether an instance is actually up, whether it can reach PostgreSQL and Keycloak, or whether the setup-service it delegates every build to is alive. Today we find out when a user's build fails.

Proposal:

• Add spring-boot-starter-actuator (and micrometer-registry-prometheus if we have a scraper).
• Expose /actuator/health with liveness and readiness groups, /actuator/info with build info so a running instance reports its git commit, and optionally /actuator/prometheus. Keep management.endpoints.web.exposure.include explicit; env, beans and heapdump stay closed.
• In SecurityConfiguration, permit GET /actuator/health/** without a token next to the existing permitAll matchers, and require the normal role for the rest (or move management to a separate port that isn't published).
• Add HealthIndicators for the two upstreams we can't work without: the setup-service (it already ships actuator, so GET {base_url}/actuator/health with a short timeout is enough) and Keycloak (the realm's OpenID configuration endpoint). PostgreSQL and Flyway are covered by the built-in indicators.
• Wire it into the containers: a HEALTHCHECK in the backend Dockerfile hitting /actuator/health/liveness, a healthcheck: on the methodologist service in compose, and depends_on: condition: service_healthy for the databases and Keycloak so docker compose up stops racing the app against its dependencies.
• Mention the endpoints in the README's local dev section.

Done means: liveness answers 200 without a token, /actuator/health shows details only with a token, stopping the setup-service container flips readiness to DOWN and back, /actuator/info shows the commit, no other actuator endpoint is reachable anonymously (with a security test to prove it), and docker compose up waits for its dependencies.