Phase 2: Externalize datasource secrets + remove debug output

[devin-ai-integration]

Summary

Phase 2 of the modernization plan: remove committed credentials and debug noise. Version-independent, low-risk changes. Stacked on top of the Phase 1 PR (#47) so the integration-test safety net verifies behavior is unchanged (21 tests still green).

Base branch is the Phase 1 branch, not master. Once #47 merges, this retargets cleanly to master.

Secrets externalized (application.properties)

-spring.datasource.username = root
-spring.datasource.password = avengers1993
+spring.datasource.url = ${DB_URL:jdbc:mysql://localhost:3306/onlinebanking}
+spring.datasource.username = ${DB_USERNAME}
+spring.datasource.password = ${DB_PASSWORD}

Required env vars (DB_USERNAME, DB_PASSWORD, optional DB_URL) are documented in the README. The previously committed password must be treated as compromised and rotated on the DB server — flagged in the README (this repo has no infra I can rotate directly).

Credential/debug leaks removed

• User.toString() no longer includes the password field (it would otherwise leak the (encoded) password into any log line that prints a User).
• UserServiceImpl.disableUser: dropped two System.out.println calls; the disable action is now a single LOG.info.
• RequestFilter: e.printStackTrace() → LOG.error(...), and the System.out.println("Pre-flight") → LOG.debug(...). (This filter is retired entirely in Phase 6.)

Verification

mvn clean test → 21 tests, 0 failures. Tests are unaffected because the test profile supplies its own H2 datasource properties, which shadow the main application.properties.

Link to Devin session: https://app.devin.ai/sessions/82be2e41fda54343a20a9b73e01c0631
Requested by: @gaelkekatos-jpg

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring