feat(audit): production hardening, targeted cache eviction, and architecture audit remediation (Phase 9B)

[shashankch]

• Enforce production JWT secret validation (>= 256 bits, non-default) failing fast on insecure configuration in prod profile
• Mitigate Broken Object Level Authorization (BOLA) by restricting GET /api/v1/users and /balance/{amount} to ROLE_ADMIN
• Harden CORS configuration to disallow credentials when wildcard origin (*) is present
• Prevent clickjacking attacks by setting frameOptions().sameOrigin() in SecurityConfig
• Handle Spring 6.1+ / Spring 7 HandlerMethodValidationException, ConstraintViolationException, and MethodArgumentTypeMismatchException in GlobalExceptionHandler
• Add boundary validation for Idempotency-Key header (max 255 chars, alphanumeric regex)
• Implement OutboxCleanupService with daily cron (0 0 2 * * *) purging completed events older than 7 days via Spring Modulith CompletedEventPublications
• Replace global cache eviction (allEntries = true) in TransactionService with targeted eviction for affected user, transaction, and ledger keys
• Integrate maven-failsafe-plugin 3.5.6 for containerized integration tests (*IT.java) during verify phase
• Add repository slice tests TransactionRepositoryTest and IdempotencyRepositoryTest (@DataJpaTest)
• Add unit tests for OutboxCleanupServiceTest, IdempotencyFilterTest, UserControllerTest, and JwtTokenProviderTest (150 tests passing)
• Extend Flyway V6 migration with event_publication_archive table and indexes to satisfy Spring Modulith 2.0 ArchivedJpaEventPublication entity during Hibernate ddl-auto: validate
• Align User.phoneNumber length (10 chars) and Transaction join column nullability (nullable = false) with Flyway DDL
• Configure @AutoConfigureTestRestTemplate on AbstractIntegrationTest and include spring-boot-restclient for Spring Boot 4.1 test client autowiring
• Adopt Testcontainers Singleton Container pattern in AbstractIntegrationTest and KafkaOutboxIT preventing premature container termination across test classes
• Pass injected topic parameter to EventExternalizationConfiguration and payflowTransfersTopic in KafkaConfig resolving CGLIB null field routing
• Declare explicit topic and key expression on TransferCompletedEvent via @Externalized("payflow.transfers::#{senderUpi()}")
• Configure ByteArraySerializer in application-kafka.yml ensuring raw serialized event bytes on Kafka topics for Spring Modulith externalization
• Bind TaggedRateLimiterMetrics and TaggedCircuitBreakerMetrics MeterBinders in Resilience4jConfig exporting resilience metrics to Micrometer and Prometheus
• Add Resilience4j configs templates and fallback to instance configuration in UserRateLimiterService to ensure per-user rate limiting enforcement
• Align ResilienceIT transaction status assertion with TransactionStatus.COMPLETED enum
• Catch client exceptions during UPI validation in UpiValidationService and recover with fallback response during external downtime
• Align HTTP 422 assertion for RFC 9110 status code compatibility and add authenticated user headers for BOLA in TransferLifecycleIT
• Warm up Kafka consumer partition assignment and extend poll timeout in KafkaOutboxIT
• Standardize documentation across CONVENTIONS.md, ROADMAP.md, API_SPECIFICATION.md, and README.md on RFC 9457 and Eclipse Formatter
• Clean up inline fully-qualified imports across codebase adhering to clean code standards and repository import conventions
• Record ADR-025 (Production Hardening and Architecture Audit Remediation) and synchronize API spec, architecture documentation, roadmap, and changelog