src/KArtSell.Host/Features/Health/PingEndpoint.cs

@@ -15,7 +15,7 @@ public class PingEndpoint : Endpoint<PingRequest, PingResponse>
     public override void Configure()
     {
         Get("/health/ping");
-        AllowAnonymous();
+        Roles("Admin", "Analyst", "System");  // Health checks require authentication
     }
 
     public override async Task HandleAsync(PingRequest req, CancellationToken ct)

src/KArtSell.Host/Features/Observability/GetMetricsEndpoint.cs

@@ -36,8 +36,7 @@ public class GetMetricsEndpoint : Endpoint<EmptyRequest, MetricsResponse>
     public override void Configure()
     {
         Get("/observability/metrics");
-        Roles("Admin", "Analyst");
-        AllowAnonymous();  // Override for demo; require auth in production
+        Roles("Admin", "Analyst", "Auditor");  // Financial compliance requires authentication
     }
 
     public override async Task HandleAsync(EmptyRequest req, CancellationToken ct)