Deepen account provisioning policy

[Pan14ek]

Purpose

Deepen the account registration provisioning path so default role and plan decisions are concentrated behind one policy seam, while generic user create/update no longer applies caller-supplied roles.

Type

• 🧪 Experiment (fitness function research)
• ✨ Feature (new business logic)
• 🐛 Bug fix
• ♻️ Refactor / neutral change
• 📝 Documentation only

Changes

• Added typed provisioning configuration through AccountProvisioningProperties.
• Added AccountProvisioningSpec so registration consumes one policy decision instead of separate primitive role/plan/active flags.
• Added reusable built-in role and plan enum values for default provisioning names.
• Updated registration to use the provisioning spec for default roles, plan lookup, and subscription activation.
• Removed role mutation from generic user create/update; role changes now stay behind account/role service paths.
• Updated tests to use constants for repeated values and cover ignored caller-supplied roles.

Files changed

File	Change
LinedBackendApplication.java	Enables configuration properties scanning.
app/AccountProvisioningProperties.java	Adds typed lined.provisioning defaults.
app/AccountProvisioningPolicy.java	Returns a single default registration spec.
app/AccountProvisioningSpec.java	Adds immutable provisioning decision record.
app/AccountApplicationServiceImpl.java	Applies default registration spec during signup.
role/domain/BuiltInRole.java	Adds reusable built-in role values.
plan/domain/BuiltInPlan.java	Adds reusable built-in plan values.
user/service/UserServiceImpl.java	Stops resolving DTO roles during create/update.
Tests	Updates provisioning and user service coverage.

Expected result

Metric	Baseline (main)	Branch	Direction
checkstyle_violations		passes locally	neutral
spotbugs_total		passes locally	neutral
line_coverage		JaCoCo generated locally	neutral
critical_violations		unknown	neutral
code_smells		unknown	neutral
duplicated_lines_density		unknown	neutral
F score		unknown	neutral
SonarQube QG		unknown	neutral

Checklist

• ./gradlew check passes locally
• ./gradlew jacocoTestReport passes locally
• No unintended changes to main business logic
• Branch name matches experiment/feature naming convention

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
93.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud