feat(ai): Gen-AI spend insights, Virtual Threads, and prod-light resource optimization (Phase 10)

[shashankch]

• Integrate Spring AI 2.0.1 GA (spring-ai-starter-model-openai) via spring-ai-bom dependency management
• Upgrade dependencies to latest 2026 stable releases: Spring Modulith 2.1.1, Springdoc OpenAPI 3.1.1, Caffeine 3.3.0, Testcontainers 1.21.4, Spotless 3.10.3, and Versions Plugin 2.22.0
• Create immutable Java 25 record SpendInsightResponse with category, amount, summary, budgetingTip, confidenceScore, and source
• Implement AiConfig registering ChatClient bean conditionally on ChatClient.Builder availability
• Implement LlmInsightClient with Spring AI fluent ChatClient structured output conversion and Resilience4j circuit breaker (aiCircuitBreaker)
• Implement deterministic 8-category rule-based keyword fallback in LlmInsightClient guaranteeing zero-downtime offline categorization
• Implement SpendInsightsService and SpendInsightsServiceImpl with principal transaction access verification and payflow.ai.enabled feature toggle
• Create FeatureDisabledException with RFC 9457 HTTP 503 ProblemDetail centralized error handler in GlobalExceptionHandler
• Expose POST /api/v1/transactions/{id}/insights endpoint on TransactionController with multi-party principal authorization
• Add Spring Boot 4.1 compatibility stubs for RestClientAutoConfiguration and WebClientAutoConfiguration resolving Spring 7 package relocations
• Exclude unused Spring AI auto-configurations (speech, transcription, image, moderation, embedding, chat) resolving Spring Framework 7 HttpHeaders binary compatibility
• Enable Java 25 Project Loom Virtual Threads globally via spring.threads.virtual.enabled: true in application.yml
• Configure bounded HikariCP connection pool parameters (idle-timeout: 300000ms, max-lifetime: 1800000ms, connection-timeout: 30000ms) in application-prod.yml
• Introduce lightweight single-node application-prod-light.yml profile with local Caffeine cache, bounded pool size (5), and in-process Modulith event dispatching
• Enforce strict JWT secret validation for prod-light profile in JwtTokenProvider
• Restrict TransferEventListener to local, test, and prod-light profiles preventing duplicate in-process dispatching when Kafka externalization is active
• Add unit tests SpendInsightsServiceTest and expand TransactionControllerTest with 165 total unit tests passing
• Author ADR-026 (Gen-AI Spend Categorization with Spring AI and Circuit Breaker Fallback) and ADR-027 (Java 25 Virtual Threads and Bounded HikariCP Connection Pool Optimization)
• Synchronize API_SPECIFICATION.md, ARCHITECTURE.md, ROADMAP.md, CHANGELOG.md, and README.md with Phase 10 deliverables