⭐ User Service

user-service is identity and auth — gRPC only, no HTTP surface at all. Port, schema, and how it fits alongside the other five services are on the services-reference.html diagram.

Two real security fixes came out of the code-review audit here, not just cleanup: a login-enumeration issue (CWE-203 — NOT_FOUND/UNAUTHENTICATED/PERMISSION_DENIED used to be individually distinguishable across user-service's three login failure modes, collapsed to one generic UNAUTHENTICATED) and its timing-side-channel sibling (CWE-208 — the password comparison now runs at constant cost on every path, including a dummy-hash comparison when no user is found at all). Full write-up: docs/code-review.md.

This was also the first module in the repo to use Lombok and the first to actually boot a Spring ApplicationContext in a test — both surfaced real JDK-25-vs-tooling incompatibilities. See Testing Strategy.