Play Framework

docs: new feature sections — HTTP server, OpenAPI, observability, security headers, JSON logs, env vars (PF-84 part 3)

Adds three new manual pages and extends four existing ones to cover the
fork's new features as part of bringing documentation/manual/ up to date
as the official Play 1.12 manual.

New pages:

* documentation/manual/httpserver.textile — HTTP/1.1 / HTTP/2 / HTTP/3
  protocol matrix, TLS configuration with PEM cert+key (and the
  enable-https quick start), virtual-thread execution model, brotli /
  gzip / deflate / zstd compression, and operational notes covering UDP
  firewall rules, the QUIC token-handler caveat, and the no-h2c-upgrade
  policy.
* documentation/manual/openapi.textile — re-purposed from
  documentation/fork-features/openapi.textile (which Agent 1 will
  delete). Content moved largely verbatim with three adjustments: dropped
  the "this is a fork-specific feature" disclaimer, opened with
  cross-links to routes.textile and controllers.textile, and confirmed
  the existing #endpoints / #configuration / #default / #annotations
  (with #operation / #response / #request-body / #parameter / #tag
  sub-anchors) / #example / #limitations / #static-export anchors match
  Agent 1's TOC.
* documentation/manual/observability.textile — health endpoints
  (/@health/live and /@health/ready with the HealthCheck SPI),
  Micrometer-based metrics with Prometheus exposition at /@metrics
  (JVM binders, http_server_requests timer, the play.libs.Metrics
  facade for app code), and the OTLP push exporter that joins a
  CompositeMeterRegistry alongside Prometheus when
  metrics.otlp.endpoint is set.

Extended pages (existing content preserved):

* security.textile — three new sub-sections after the existing
  Sessions / XSS / SQL / CSRF topics: <a name="headers"> for the
  SecurityHeadersPlugin defaults table and per-response override
  semantics; <a name="cors"> for the opt-in CorsPlugin including
  wildcard-with-credentials safety and Vary: Origin caching; and
  <a name="samesite"> for application.session.sameSite plus the
  RFC-required automatic Secure flag when SameSite=None.
* logs.textile — new <a name="json"> section covering
  application.log.format=json (default text), the bundled ECS Layout
  template via Log4j 2's JsonTemplateLayout, and the per-request
  ThreadContext fields (request_id, http_method, http_path, client_ip,
  action_name) pushed by ActionInvoker.invoke().
* configuration.textile — new <a name="envvar"> section covering
  ${ENV_VAR} placeholder syntax with the ${ENV_VAR:-default} fallback
  form, load-time resolution, and the WARN-on-missing-secret behavior.
* routes.textile — short forward-link paragraph at the end pointing to
  openapi.textile, anchored at <a name="openapi"> so Agent 1's TOC can
  link straight to it.

Anchor naming follows the existing manual convention (file-level links
unless an anchor is critical; lower-case anchor names; no underscores).
The httpserver page uses sub-anchors (#protocols, #tls, #enable-https,
#virtual-threads, #compression, #operational) for navigation depth, but
external cross-links from other manual pages stay file-level.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>