refactor(usermanagement): implement code review findings for User Management BC

Address all 18 findings from security code review (5 critical, 7 medium, 6 low):

Domain: make User and Role immutable with wither-pattern, add status transition
guards (ACTIVE->LOCKED, LOCKED->ACTIVE, ACTIVE|LOCKED->INACTIVE, INACTIVE->ACTIVE)

Application: enforce authorization via AuthorizationPort in all use cases, add
input validation, introduce LockUserCommand/UnlockUserCommand/RemoveRoleCommand,
fix audit event on password change failure (K5), use flatMap/mapError chains

Infrastructure: JWT blacklist with TTL and scheduled cleanup, login rate limiting
(5 attempts/15min), configurable CORS, generic error messages, conditional Swagger,
seed data context restriction

Tests: unit tests for all 10 use cases, adapted domain and integration tests

backend/src/main/resources/application-prod.yml

@@ -0,0 +1,17 @@
+springdoc:
+  api-docs:
+    enabled: false
+  swagger-ui:
+    enabled: false
+
+logging:
+  level:
+    root: WARN
+    de.effigenix: INFO
+    org.springframework.security: WARN
+    org.hibernate.SQL: WARN
+
+server:
+  error:
+    include-message: never
+    include-binding-errors: never

backend/src/main/resources/application.yml

@@ -47,10 +47,16 @@ logging:
     org.springframework.security: DEBUG
     org.hibernate.SQL: DEBUG
 
+# CORS Configuration
+effigenix:
+  cors:
+    allowed-origins: ${CORS_ALLOWED_ORIGINS:http://localhost:3000}
+
 # API Documentation
 springdoc:
   api-docs:
     path: /api-docs
+    enabled: ${SWAGGER_ENABLED:true}
   swagger-ui:
     path: /swagger-ui.html
-    enabled: true
+    enabled: ${SWAGGER_ENABLED:true}

backend/src/main/resources/db/changelog/changes/004-seed-admin-user.sql

@@ -1,26 +1,18 @@
 -- Seed Admin User for initial system access
--- Username: admin
--- Password: admin123
--- BCrypt hash with strength 12
 
--- Insert Admin User
 INSERT INTO users (id, username, email, password_hash, branch_id, status, created_at, last_login)
 VALUES (
-    '00000000-0000-0000-0000-000000000001',  -- Fixed UUID for admin
+    '00000000-0000-0000-0000-000000000001',
     'admin',
     'admin@effigenix.com',
-    '$2a$12$SJmX80hUZoA66W77CX7cHeRw1TPscXD6S8HYEZfhJ5PxTfkbwbLdi',  -- BCrypt hash for "admin123"
-    NULL,  -- No branch = global access
+    '$2a$12$SJmX80hUZoA66W77CX7cHeRw1TPscXD6S8HYEZfhJ5PxTfkbwbLdi',
+    NULL,
     'ACTIVE',
     CURRENT_TIMESTAMP,
     NULL
 );
 
--- Assign ADMIN role to admin user
 INSERT INTO user_roles (user_id, role_id)
 SELECT '00000000-0000-0000-0000-000000000001', id
 FROM roles
 WHERE name = 'ADMIN';
-
--- Add comment
-COMMENT ON TABLE users IS 'Default admin user: username=admin, password=admin123 (CHANGE IN PRODUCTION!)';

backend/src/main/resources/db/changelog/db.changelog-master.xml

@@ -8,7 +8,7 @@
     <include file="db/changelog/changes/001-create-user-management-schema.xml"/>
     <include file="db/changelog/changes/002-seed-roles-and-permissions.xml"/>
     <include file="db/changelog/changes/003-create-audit-logs-table.xml"/>
-    <include file="db/changelog/changes/004-seed-admin-user.xml"/>
+    <include file="db/changelog/changes/004-seed-admin-user.xml" context="dev"/>
     <include file="db/changelog/changes/005-create-masterdata-schema.xml"/>
     <include file="db/changelog/changes/006-create-supplier-schema.xml"/>
     <include file="db/changelog/changes/007-create-customer-schema.xml"/>