Health Test Endpoints Leak Authentication Details in Development

At health.controller.ts#L89-L91 and L113-L115:

public testAdminAuth(@CurrentApiKey() apiKey: LoggedInApiKey): Record<string, unknown> {
  this.assertNotProduction();
  return { authType: "admin", apiKeyId: apiKey.apiKeyId, partnerId: apiKey.partnerId };
  // L91, echoes back credentials
}

public testCustomerAuth(@CurrentCustomer() customer: LoggedInCustomer): Record<string, unknown> {
  this.assertNotProduction();
  return { authType: "customer", walletAddress: customer.walletAddress, partnerId: customer.partnerId };
  // L115
}

These endpoints return API key IDs, partner IDs, and wallet addresses, useful for enumeration attacks in the dev environment.

In dev environments, callers can enumerate credentials and bind them to wallets/partners.

Return only a boolean success indicator, not authentication details.

Accepted by team. Endpoints are prod-disabled via assertNotProduction() and only echo the caller's own credential identity; the returned fields are load-bearing test observables in health-auth.e2e.ts and throttling.e2e.ts.