docs: feature - reverse-engineering & code-forward architecture

[devin-ai-integration]

Summary

Adds docs/architecture/reverse-engineering-and-code-forward.html — a self-contained (inline CSS + Mermaid 10) architecture knowledge base produced by the Reverse-Engineering & Code-Forward Architecture playbook at commit 305826d. No application, build, or schema files are changed.

Sections 1–5 are observed (every row cites file:line); 6–7 are proposed. 7 A4 pages, 5 diagrams, all rendered as SVG with no syntax errors.

Top findings (14 total, F1–F14):

• F1 AccountService.transferAmount does 4 independent save() commits with no @Transactional and no @Version — a failure mid-way creates or destroys money (AccountService.java:103-135).
• F3 Amount is a raw BigDecimal; zero/negative amounts pass every check, so a negative transfer pulls funds from the recipient (AccountService.java:104, BankController.java:83).
• F4/F5 LocalDateTime.now() is called twice per transfer; Account is both the JPA entity and the Spring Security principal.
• F9 CSRF disabled on all state-changing POSTs (SecurityConfig.java:29).
• F10 CI/CD provenance drift: pipelines clone the upstream LondheShubham153 fork, CI pushes madhupdevops/bankapp, K8s runs trainwithshubham/bankapp-eks, Helm runs trainwithshubham/springboot-bankapp, and the GitOps sed targets bankapp-deployment.yaml while the file is .yml.
• F11/F12 /actuator/health probed by compose and Helm but spring-boot-starter-actuator is absent from pom.xml; DB password Test@123 committed in 5 files.

Proposed target: 7 bounded contexts (Platform ACL · Identity & Access · Account Ledger · Payment Policy · Transaction History · Audit Trail · Web UI), one writer per table, and a 6-slice strangler roadmap (S1 Platform ACL → S6 Payment Policy). No slice is marked complete.

Key figures

Inventory with full evidence: ~/inventory/Springboot-BankApp.md (kept outside the repo per playbook).

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/0a935b86443d4362b9b81a34dec51e12
Open in Devin Desktop: https://app.devin.ai/desktop/session/0a935b86443d4362b9b81a34dec51e12?variant=devin
Requested by: @patrickbradley-cog

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring