Serve detailed health map on the metrics port (follow-up to #3802)

Summary

Follow-up to #3802. That issue's unauthenticated infrastructure-disclosure via /.well-known/health is now closed by redacting the public endpoint to {name, status} (PR TBD). This ticket tracks the second half of #3802's proposed design: relocate the detailed health map to the metrics server so ops tooling can still consume it, behind the same network boundary as /metrics and /debug/pprof.

Current state (after the redaction fix)

Endpoint	Port	Body
/.well-known/alive	HTTP_PORT (8000)	{"status":"UP"} — liveness (unchanged)
/.well-known/health	HTTP_PORT (8000)	{"name","status"} — readiness, redacted
(the detailed map)	—	not exposed anywhere — only Container.Health() internally

The full per-dependency map (hosts, ports, DB/keyspace/bucket names, pool stats, ES username) is still computed by Container.Health(ctx) but is no longer served on any endpoint.

Proposed change

Serve the full detailed map at /health on the metrics server (METRICS_PORT, default 2121), next to /metrics and /debug/pprof:

Endpoint	Port	Body	Purpose
/.well-known/alive	HTTP_PORT	{"status":"UP"}	liveness
/.well-known/health	HTTP_PORT	{"name","status"}	readiness (redacted)
/health	METRICS_PORT	full detailed map	ops-only, behind the metrics/pprof network boundary

Feasibility

Low-risk wiring — metricServer.Run already receives *container.Container (pkg/gofr/metrics_server.go), so a handler on the metrics router can call c.Health(ctx) directly. metrics.GetHandler needs the container passed alongside the metrics manager. METRICS_PORT=0 disables the detailed endpoint entirely.

Caveats

• The metrics server binds :port (all interfaces), same as today's /debug/pprof — so "private" means not exposed through ingress, identical to pprof's current guarantee. It is not loopback-bound (that would break in-cluster Prometheus scraping). The boundary is network policy — worth stating in docs.
• Adding /health to the metrics port is a new documented endpoint; call it out in release notes.

Related

• #3802 — the disclosure and the redaction fix (this ticket is its deferred second half).
• #2550 — original /.well-known auth exemption.