feature: upgrade to Spring Boot 3.5 / Java 17 (Jakarta, SecurityFilterChain, DGS 9)

[yubin-jee]

Summary

Moves the app off EOL Spring Boot 2.6.3 onto Spring Boot 3.5.16 with a Java 17 toolchain and Gradle 8.5.

Non-obvious parts of the upgrade:

• WebSecurityConfig no longer extends WebSecurityConfigurerAdapter; it exposes a SecurityFilterChain bean with the lambda DSL (authorizeHttpRequests / requestMatchers). Rules, HttpStatusEntryPoint(401), stateless sessions, CORS source and JwtTokenFilter placement before UsernamePasswordAuthenticationFilter are unchanged.
• javax.servlet.* / javax.validation.* → jakarta.* everywhere in src (javax.crypto is JDK and untouched).
• DGS: graphql-dgs-spring-boot-starter:4.9.21 → DGS platform BOM 9.2.2 + graphql-dgs-spring-graphql-starter (DGS now runs on Spring for GraphQL). Consequences:
  • graphql.relay.DefaultPageInfo is no longer accepted for the codegen'd PageInfo type, so ArticleDatafetcher/CommentDatafetcher build io.spring.graphql.types.PageInfo directly.
  • DataFetcherExceptionHandler.onException → handleException(...) returning CompletableFuture.
  • New GraphQlJacksonConfiguration: the app sets spring.jackson.deserialization.UNWRAP_ROOT_VALUE=true for the REST payload envelope ({"user": {...}}), which broke deserialization of Spring GraphQL's SerializableGraphQlRequest. It registers a copy of the ObjectMapper with that feature disabled for just that request type.
• Dependency bumps for Jakarta compatibility: MyBatis starter 3.0.5, REST Assured 5.4.0, jjwt 0.11.5, sqlite-jdbc 3.45.3.0. flyway-core stays Boot-managed (Flyway 11 keeps SQLite in core, flyway-database-sqlite isn't published).
• CustomizeExceptionHandler signature: HttpStatus → HttpStatusCode (Spring 6 ResponseEntityExceptionHandler).

Verified: ./gradlew spotlessJavaApply && ./gradlew clean build (68 tests pass), plus bootRun smoke: GET /tags 200, GET /user 401, POST /graphql {__typename} 200.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/222ad18312c342b8a08bb4c917347188
Open in Devin Desktop: https://app.devin.ai/desktop/session/222ad18312c342b8a08bb4c917347188?variant=devin
Requested by: @yubin-jee

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring