Hardening/contract stabilization

[MarkADom]

Summary

Standardized API error semantics to stabilize backend contract behavior and remove accidental 500 responses.
Introduced explicit domain exceptions for clearer intent and predictable status mapping:

• ResourceNotFoundException → 404 Not Found
• AccessDeniedException → 403 Forbidden
• DomainConflictException → 409 Conflict
• InvalidInputException → 400 Bad Request
  Updated global exception handling to consistently map validation/auth/domain failures (MethodArgumentNotValidException, ConstraintViolationException, JWT/auth errors) to expected HTTP responses.
  Replaced service-layer throws of framework/generic exceptions (ResponseStatusException, IllegalArgumentException, NoSuchElementException) in hardened paths with domain-level exceptions.
  Removed accidental 500 propagation hotspots caused by unsafe Optional access and require(...) failures in touched flows.
• Updated Bruno integration checks where validation/authorization/not-found paths previously expected incorrect 500 statuses.

Type of change

• feat
• fix
• refactor
• docs
• test
• ci

Validation

• I ran local checks
• I included commands/results below

Commands run:

./gradlew test --tests 

Docs impact

• No docs change needed
• Updated README/docs
• Updated API tests (Bruno)

Security impact

• No security impact
• Security-relevant change explained below

This change improves contract hardening for authentication/authorization/validation responses by preventing ambiguous or accidental 500 leaks and enforcing deterministic HTTP semantics (401/403/404/400/409) across touched backend flows.

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
86.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud