Rewrite Gamma services in Kotlin

[Portals]

Summary

• replace the primary Java/Spring MVC runtime with a modular Kotlin application built on Ktor and Exposed
• organize identity, organization, API access, OAuth, onboarding, throttling, media, and platform behavior around explicit domain boundaries
• harden password, session, API credential, OAuth authorization, revocation, account retirement, and administrative mutation lifecycles
• add structured security audit events, request correlation, health/readiness endpoints, Prometheus metrics, and bounded failure behavior
• add reproducible local development, a pinned distroless image, dependency locking and verification, SBOM generation, vulnerability scanning, and release attestations
• consolidate regression coverage across unit, integration, architecture, schema, container, and browser tests

Operational notes

• application startup validates the packaged database migrations without mutating the schema
• Redis supports authenticated TLS connections and owns sessions, OAuth state, throttling, credential receipts, and revocation barriers
• make dev starts the current application with isolated PostgreSQL and Redis services; make dev-down is idempotent
• liveness, readiness, metrics, structured logs, and request identifiers are available for deployment monitoring

Verification

• ./gradlew check aggregateCoverageReport integrationTest — 154 tasks passed
• pnpm format:check
• pnpm typecheck
• pnpm lint
• pnpm audit --audit-level=high — no known vulnerabilities
• ./gradlew :app:buildImage
• make dev and repeated make dev-down
• make e2e — 18 browser scenarios passed

Resolves #957
Resolves #958
Resolves #959
Resolves #960

[Portals]

This has bee rewritten in various goals using Codex and GPT 5.6 Sol.

Going to start reviewing the code all and all.