Release/v1.0.0 hardening

[MarkADom]

Summary

Standardized action/message responses to ApiMessageResponseDTO across key controllers, including root/home and admin cache clear endpoints, improving response consistency for clients.
Hardened actuator/security behavior by limiting dev actuator exposure and enforcing EndpointRequest rules (health/info public, all other actuator endpoints ADMIN-only).
Strengthened notification permission checks in service layer with actor-context validation across board/project/task contexts and admin override; also tightened markAllAsRead actor/target scope rules.
Improved deprecation hygiene by marking email-path aliases as deprecated (Use /me variant), keeping principal-equality guards, delegating to /me handlers, and hiding deprecated aliases from OpenAPI.

Type of change

• feat
• fix
• refactor
• docs
• test
• ci

Validation

• I ran local checks
• I included commands/results below

Commands run:

 ./gradlew test detekt jacocoTestReport sonarqube 

Docs impact

• No docs change needed
• Updated README/docs
• Updated API tests (Bruno)

Security impact

• No security impact
• Security-relevant change explained below

Actuator exposure in application-dev.yml is restricted to health,info,env,mappings,metrics.
SecurityConfig uses actuator-aware rules:
- EndpointRequest.to("health","info") => permitAll
- EndpointRequest.toAnyEndpoint() => requires ADMIN
Notification service permission model now validates actor context for board/project/task and enforces non-admin self-scope on markAllAsRead.
Deprecated email-path aliases remain for compatibility but are hidden from OpenAPI and guarded by principal equality checks.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
82.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud