Spring Security baseline

What every endpoint must declare

In 03-design.md, for each new/changed endpoint:

• AuthN: Anonymous? Bearer (JWT)? Session? mTLS?
• AuthZ: What role/scope/claim is required?
• Input validation: Bean Validation on the DTO (@NotNull, @Size, @Pattern, …) PLUS service-layer invariants.
• Output: Does the response include any field the caller is not allowed to see?
• Audit: Should this action be logged with structured fields (actor, subject, outcome)?

If any of these is unclear, write a Q-NNN — do not pick a default.

Default SecurityFilterChain (resource server, JWT)