docs: refresh documentation to match current codebase

[lburgers]

Summary

Documentation-only refresh. No Java, SQL, schema, or build changes.

Reviewed: build.gradle / Gradle wrapper, application*.properties, REST controllers and security (io.spring.api), DGS fetchers/mutations and schema.graphqls (io.spring.graphql), domain (io.spring.core), command/query services and pagination (io.spring.application), MyBatis repositories/read services/mapper XML (io.spring.infrastructure), Flyway migration, tests.

Docs changed:

• README.md — rewritten. The old README described the project as "Kotlin and Spring" (it is Java 11 source / Gradle 7.4 / Spring Boot 2.6.3). Now has an accurate stack + version table, setup/run/test/format commands, SQLite (dev.db, deleted by ./gradlew clean; in-memory under the test profile, except RealworldApplicationTests which boots against dev.db) and Flyway notes, package layout, REST + GraphQL overviews, JWT auth notes, and a warning that io.spring.graphql types under build/generated are DGS-codegen output and must not be hand-edited.
• docs/architecture.md (new) — intended layering (api/graphql → application → core ← infrastructure, noting the read-side leak where application imports infrastructure.mybatis.readservice.*), CQRS-lite write path (entities + repository interfaces) vs read path (*Data DTOs via *ReadService), offset vs Relay cursor pagination (DateTimeCursor = createdAt epoch ms), security/route rules, error formats, persistence, generated sources, test layout.
• docs/api.md (new) — full REST endpoint reference (no /api prefix; Authorization: Token <jwt>; offset/limit default 0/20), error format, and GraphQL query/mutation reference with [REDACTED SECRET]s.

Verification:

• ./gradlew compileJava compileTestJava (JDK 17) — passes.
• ./gradlew spotlessJavaCheck — see follow-ups; failures are pre-existing and reproduce on untouched master.

Recommended follow-ups (not changed here)

1. Spotless is broken on JDK 17: :spotlessJava fails with InvocationTargetException (google-java-format via Spotless 6.2.1 needs JDK 11 or --add-exports flags). On JDK 11 it runs but reports a pre-existing format violation in src/test/java/io/spring/infrastructure/service/DefaultJwtServiceTest.java. Run spotlessJavaApply on JDK 11 or bump Spotless/google-java-format.
2. GraphQL anonymous handling is inconsistent: me and updateUser return null, feed passes a null user down and fails with a generic INTERNAL error, only login raises a typed UNAUTHENTICATED. MeDatafetcher also echoes the raw Authorization header back as token.
3. Two auth exception types: io.spring.graphql.exception.AuthenticationException is not handled by GraphQLCustomizeExceptionHandler (only InvalidAuthenticationException is mapped to UNAUTHENTICATED), so it surfaces as a generic DGS INTERNAL error.
4. GraphQL pagination: first/last exclusivity is not enforced (both accepted, first wins; error message is in Chinese), and CommentReadService.findByArticleIdWithCursor applies the cursor but no LIMIT, so Article.comments ignores page size.
5. JwtTokenFilter does header.split(" ")[1] with no length check — a header like Token (no value) throws ArrayIndexOutOfBoundsException instead of being ignored.
6. Layering: application query services depend directly on infrastructure.mybatis.readservice.*; moving those interfaces into application would restore the intended dependency direction.
7. RealworldApplicationTests runs without the test profile, so ./gradlew test touches the real dev.db file.
8. CORS allows * origins with all methods in WebSecurityConfig — fine for a demo, but worth noting.
9. Outdated dependencies: Spring Boot 2.6.3 (EOL), Gradle 7.4, DGS 4.9.21 / codegen 5.0.6, jjwt 0.11.2, SQLite JDBC 3.36.0.3, Joda-Time (could move to java.time).
10. jwt.secret is committed in application.properties; should be externalised for anything beyond local dev.
11. Note: the task referenced ankehao-demo/spring-boot-realworld-[REDACTED SECRET]-app, which was not accessible; this PR targets the COG-GTM fork.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/585ab08bbd78428091e7d62db4ac3a39
Open in Devin Desktop: https://app.devin.ai/desktop/session/585ab08bbd78428091e7d62db4ac3a39?variant=devin
Requested by: @lburgers

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring