garage: name what the admin port actually serves

/metrics needs no authentication in this configuration either -
metrics_require_token defaults to false - and an admin token can also come from
the cluster (garage admin-token create), not only from garage.toml.

garage.md

@@ -13,7 +13,7 @@ That trade is deliberate, and the price is the first thing to understand about t
 | Ingress | **off by default**, built to the convention so it can be switched on |
 | External dependencies | none — no database, no cache, no other service |
 | Secrets | 2 × `OnePasswordItem`, four fields in total |
-| Network | ClusterIP Service on 3900 (S3) and 3903 (admin). No RPC port in the Service, and no NetworkPolicy yet |
+| Network | ClusterIP Service on 3900 (S3) and 3903 (admin). No RPC port in the Service, and no NetworkPolicy yet. The admin port serves two things unauthenticated — `/health` (token-free by design, the probes need it) and `/metrics` (`metrics_require_token` defaults to **false**) — and answers everything else with 401/403 until an admin token exists, from the config *or* from `garage admin-token create` |
 | Install-test | `ci/garage/` (fixtures + test values) |
 
 ## Prerequisites