feature: add unit tests for untested layers and JaCoCo coverage report

[devin-ai-integration]

Summary

Adds tests for previously untested code and wires up JaCoCo so coverage is measurable going forward.

• build.gradle: jacoco plugin; test is finalizedBy jacocoTestReport (xml + html under build/reports/jacoco/test/).
• New tests (11 files, 101 tests total, all green):
  • Pure logic: Util, CursorPager, CursorPageParameter (limit clamping to 1000 / default 20), DateTimeCursor (millis round-trip, UTC), User.update (empty values leave fields untouched), Comment.
  • Services (Mockito, no Spring context): ArticleCommandService, UserService (password encoding, default image).
  • JwtTokenFilter: header parsing edge cases, missing user, and that an existing SecurityContext authentication is not overwritten — mocks injected via ReflectionTestUtils since the filter uses field injection.
  • TagsApi (@WebMvcTest) and TagDatafetcher (first GraphQL test, via DgsQueryExecutor with DgsAutoConfiguration).

JaCoCo overall: 33% → 36% instruction coverage (denominator includes the generated DGS types, which drags the number down; the newly covered classes go to ~100%).

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/f12ea9326fb649f4b3da48e6cca71461
Open in Devin Desktop: https://app.devin.ai/desktop/session/f12ea9326fb649f4b3da48e6cca71461?variant=devin
Requested by: @shayanshafii

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.