chore: initialize from backend template 0a6dd0e

docs/runbooks/management-actuator-forbidden.md

@@ -0,0 +1,34 @@
+---
+title: Runbook — ACTUATOR_FORBIDDEN (Actuator 접근 거부)
+category: AUTHZ
+error_codes: [ACTUATOR_FORBIDDEN]
+severity: P2
+owner: oncall
+last_updated: 2026-06-15
+status: stub
+---
+
+# Runbook: ACTUATOR_FORBIDDEN (`runbook://management/actuator-forbidden`)
+
+## Symptoms
+
+- HTTP 403 with `error.code=ACTUATOR_FORBIDDEN`
+- Attempt to access restricted actuator endpoint (env/configprops/heapdump/shutdown)
+
+## Diagnosis
+
+- Identify which actuator endpoint was accessed
+- Check caller identity (internal tooling vs external)
+
+## Action
+
+- Verify management port is not exposed externally
+- For heapdump/threaddump: follow break-glass runbook procedure
+
+## Escalation
+
+- P1 if forbidden actuator access appears to be external attack
+
+---
+
+> **Stub**: Phase D2 — author body after domain adoption. (feature-operational-runbook-contract D9)