Spring Boot Actuator in Production: The Endpoints I Left Open by Accident and How I Closed Them

After publishing my Jakarta EE vs Spring Boot analysis, I audited Actuator's defaults on a backend I own and found sensitive endpoints wide open — ones I never consciously configured. Here's the hardening checklist I built afterward.