Migrate CI readiness check to /actuator/health and lock down /api/v1/data/stats

[jmjava]

Summary

The export-seed CI workflow currently polls /api/v1/data/stats as a readiness check to detect when the app is ready after ingestion. With the addition of Spring Boot Actuator in #33, there is now a proper health endpoint at /actuator/health that serves the same purpose.

/api/v1/data/stats remains permitAll() solely because the CI workflow depends on it being unauthenticated. It is not called from the frontend UI.

Proposed changes

1. Update export-seed.yml — change the readiness poll from /api/v1/data/stats to /actuator/health
2. Move /api/v1/data/stats behind auth — remove it from permitAll() in SecurityConfig.kt

Why this is safe

IngestionRunner is an ApplicationRunner, so the app only accepts HTTP requests after ingestion completes. /actuator/health has the same readiness semantics as /api/v1/data/stats — both return only after the full application context is up.

IngestionRunner calls dataManager.getStats() directly (in-process method call), so it is unaffected by this change.