[Console] Require authentication for actuator/metrics and warn on H2 default credentials

[shangeyao]

Problem

• /actuator/**, /h2-console/**, and /metrics/** are currently anonymous in Shiro, exposing management endpoints without authentication
• H2 dev profile seeds a default admin password (streampark) without a startup warning

Proposed solution

• Keep /actuator/health and /actuator/info anonymous for probes; require JWT for other actuator, H2 console, and metrics endpoints
• Log a startup WARN when H2 embedded database is detected

[shangeyao]

Closing because related PR #4389 was closed without merge. Console frontend is being refactored; this work is deferred.