UNOMI-884: Platform polish audit (Phase 2 PR 3)

[sergehuber]

Summary

Mega-PR 3 (L + M + N + O + P) §2 audit: master is already ahead on nearly all scoped paths via earlier merges (#760 UNOMI-884, #762 UNOMI-904, #773 UNOMI-883, #768 UNOMI-920, #781 UNOMI-948, #774 past-event). Blind checkout from unomi-3-dev would regress V2 auth, condition validation, rangeQuery null handling, and past-event null guards.

One residual fix ported from unomi-3-dev (UNOMI-680 tenant handling):

• GraphQLServletSecurityValidator: when JAAS auth succeeds but X-Unomi-Tenant-Id is invalid, fall back to ExecutionContext.systemContext() instead of leaving a potentially wrong tenant context.

Audit — intentionally skipped (master wins)

Bundle	Paths	Reason
L REST auth	AuthenticationFilter, V2ThirdPartyConfigService, DefaultRestAuthenticationConfig	Master #760, #762
M OpenSearch	OpenSearchPersistenceServiceImpl, past-event query builders, dispatchers	Master #781, #773, #760; 3-dev removes null guards
N GraphQL	GraphQLSchemaProvider, GraphQLSchemaUpdater	Whitespace-only diff; UNOMI-680 fixes already on master
O Validation	NumericValueTypeValidator, ComparisonOperatorValueTypeValidator, ConditionValidationServiceImpl	Master uses AbstractNumericValueTypeValidator + #773
P API toString	api/** model toString(), YamlUtils, tests	Master #768, #755

Test plan

• mvn -pl graphql/cxs-impl compile
• GraphQL request with valid JAAS credentials + invalid X-Unomi-Tenant-Id → system context, no cross-tenant leakage
• GraphQL request with valid tenant header → tenant context unchanged
• CI Javadoc + unit/integration suites