fix: resolve top 5 SonarQube issues (weekly sweep)

[choikh0423]

Summary

Weekly SonarQube sweep on choikh0423_demo-spring-boot-test-coverage (the analysis project for this repo). Ranked all 265 open issues by severity, then type, then effort/recency; no BLOCKER, BUG-severity-CRITICAL, or VULNERABILITY issues exist, so the top 5 are the 4 CRITICAL issues plus the highest-priority MAJOR one (the only MAJOR of type BUG).

#	Issue key	Severity / Type	Rule	Location	Fix
1	AZ1u3HCaEnUkF3fpjVtj	CRITICAL / CODE_SMELL	java:S1452 — generic wildcard in return type	ArticleApi.article	ResponseEntity<?> → ResponseEntity<Map<String, Object>>
2	AZ1u3HCaEnUkF3fpjVtk	CRITICAL / CODE_SMELL	java:S1452	ArticleApi.updateArticle	same
3	AZ1u3HBkEnUkF3fpjVtQ	CRITICAL / CODE_SMELL	java:S1452	CommentsApi.createComment	same
4	AZ1u3HBdEnUkF3fpjVtN	CRITICAL / CODE_SMELL	java:S1948 — non-serializable field in a Serializable class	InvalidRequestException.errors	field marked transient (Spring's Errors is not serializable; the exception is never deserialized)
5	AZ1u3HAmEnUkF3fpjVtC	MAJOR / BUG	java:S2885 — non-thread-safe field is static	DateTimeHandler.UTC_CALENDAR	a shared mutable Calendar was handed to JDBC from a singleton MyBatis type handler; replaced by a per-call instance

// DateTimeHandler
-private static final Calendar UTC_CALENDAR = Calendar.getInstance(TimeZone.getTimeZone("UTC"));
+private static final TimeZone UTC = TimeZone.getTimeZone("UTC");
+private static Calendar utcCalendar() {
+  return Calendar.getInstance(UTC);
+}

The three ResponseEntity<?> methods already returned only the Map<String, Object> produced by their private *Response helpers, so the narrowed return type is source- and wire-compatible.

./gradlew test passes. ./gradlew spotlessCheck reports no violations in the touched files; it does flag one pre-existing formatting violation in src/test/java/io/spring/infrastructure/service/DefaultJwtServiceTest.java, which is present on master and left untouched here. Running Spotless on this box also requires --add-exports=jdk.compiler/... JVM args because only JDK 17 is installed while google-java-format 1.13 (Spotless 6.2.1) needs JDK 11 internals access.

Link to Devin session: https://app.devin.ai/sessions/96fed63ba703472fa149ad69ab921c2a
Open in Devin Desktop: https://app.devin.ai/desktop/session/96fed63ba703472fa149ad69ab921c2a?variant=devin
Requested by: @choikh0423

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.