CAMEL-24498: align camel-observability-services-starter defaults with the Spring Boot baseline

[Croway]

Fixes CAMEL-24498.

What

ObservabilityServicesEnvironmentPostProcessor injects a set of management defaults as soon as camel-observability-services-starter is on the classpath. Three of them were wider than the Spring Boot or Camel setting they replaced, and this PR brings them back in line.

Property	Before	After
management.server.address	not set (listener on all interfaces)	127.0.0.1
management.endpoint.health.show-details	always	when-authorized
camel.health.exposure-level	full	not injected (Camel default default)

Everything else the starter injects is unchanged.

Why

• management.server.port was injected with no matching management.server.address. Spring Boot ships no separate management listener at all, so the starter both opens the listener and, implicitly, put it on every interface. Opening it is the starter's job; deciding how far it reaches should be the operator's. camel-jolokia-starter binds its agent to loopback for the same reason.
• show-details=always is two steps past the Spring Boot default of never. Camel health checks report on the resources a route talks to — broker connections, data sources, remote endpoints — and their detail can identify those resources. when-authorized shows the indicators to an authenticated caller and the overall status alone to everybody else; with no Spring Security on the classpath it behaves as never.
• camel.health.exposure-level=full overrode the Camel default of default. At default, CamelHealthHelper filters health check metadata (endpoint URIs, route and consumer identifiers) out of the response and keeps check names, error messages and stack traces — so failure diagnosis is unaffected. full is now documented as an opt-in.

Why the live/ready groups keep show-details=always

The JIRA left this conditional on whether the Kubernetes probe flow needs it. It does, and it costs nothing:

• The kubelet reads /observe/health/live and /observe/health/ready unauthenticated, so when-authorized would collapse to never for them.
• The kubelet puts the (truncated) HTTP response body into the probe-failure event, so kubectl describe pod names the indicator that took the pod down. With never the operator only sees the status code.
• Both groups contain availability-state indicators only. CamelLivenessStateHealthIndicator / CamelReadinessStateHealthIndicator extend Spring's LivenessStateHealthIndicator / ReadinessStateHealthIndicator, which report a status and contribute no details. So always on those groups reveals the indicator names and their UP/DOWN state, and nothing else.

Behaviour change and how to opt back in

The property source is still added with addLast, so every one of these is overridden by ordinary application configuration.

Kubernetes deployments whose kubelet probes or Prometheus scrapers reach the pod over the network must now widen the bind address explicitly:

management.server.address = 0.0.0.0

The other two:

management.endpoint.health.show-details = always
camel.health.exposure-level = full

This is called out in the starter docs and needs a note in the 4.23 upgrade guide in apache/camel (drafted separately, not part of this PR).

Docs

The starter had no hand-written doc sections. This PR adds src/main/doc/intro.adoc and src/main/doc/usage.adoc, which the generator folds into docs/spring-boot/modules/ROOT/pages/starters/observability-services.adoc (regenerated and committed). They document the endpoint layout, the full injected property set as a table, and a section each on the bind address, health detail exposure and the Camel exposure level.

A test asserts that the injected key set matches the documented table, so the two cannot drift apart silently.

Tests

mvn install -pl components-starter/camel-observability-services-starter — 10 tests, 0 failures.

• ObservabilityServicesEnvironmentPostProcessorTest (7) — extended with managementListenerBindsToLoopback, aggregateHealthDetailsRequireAuthorization, probeGroupsKeepTheirDetails, camelHealthExposureLevelIsNotForced and injectedPropertiesAreTheDocumentedSet; the existing assertions for the removed/changed values were updated.
• ObservabilityServicesOptInOverridesTest (3, new) — verifies each of the three settings can be opted back into from application configuration.

No Thread.sleep introduced; the tests are assertions over the Environment, so no waiting is involved.

Claude Code (Opus 5) on behalf of Federico Mariani