docs(garage): state the admin surface precisely, including open /metrics

"No admin_token is set" read like "nothing is open", and two parts of that
were wrong. /metrics needs no authentication either, because
metrics_require_token defaults to false - internal metrics on a ClusterIP port.
And a config token is not the only way to reach the authenticated API: Garage
2.x keeps admin tokens in the cluster as well ("garage admin-token create"),
which work without any entry in garage.toml. Both now stated at the ConfigMap
and the Service, plus the way to close /metrics.

garage/templates/garage.service.yaml

@@ -17,10 +17,12 @@ spec:
       port: {{ $settings.ports.s3 | int64 }}
       targetPort: s3
       name: s3
-    # The admin endpoint. With no admin_token configured (see the ConfigMap)
-    # this serves exactly two things without authentication, /health and
-    # /metrics, and answers everything else with 401 - so it is a monitoring
-    # surface, not a management one.
+    # The admin endpoint. With this chart's configuration it serves exactly two
+    # things without authentication - /health (token-free by design) and
+    # /metrics (because metrics_require_token defaults to false) - and answers
+    # everything else with 401/403 until an admin token exists, whether from
+    # the config or from "garage admin-token create". So it is a monitoring
+    # surface rather than a management one, and it is a ClusterIP port.
     - protocol: TCP
       port: {{ $settings.ports.admin | int64 }}
       targetPort: admin