# feature-security-operational-baseline D5 — deny-by-default public path snapshot.
# SSOT: SECURITY_PUBLIC_PATHS (src/.env) -> SecurityConfig permitAll(); anyRequest authenticated.
# Regenerate after review with: ./gradlew verifyPublicPathSnapshot -PapprovePublicPathChange
/api/healthcheck
