Add Spring Boot Actuator for health endpoint #33
Description
The guide app currently has no health endpoint. The CI export-seed workflow uses /api/v1/data/stats as a workaround to detect when the app is ready.
Add spring-boot-starter-actuator dependency and expose /actuator/health so the CI workflow (and any future monitoring/orchestration) has a proper health check.
Also consider whether /api/v1/data/stats should remain permitAll() in SecurityConfig.kt — it's currently unauthenticated but only used by logged-in users in the UI.