feat: finish demo — port demo-monolith cleanup, separate UI and API containers

Frontend
- Bring spring-angular-ui back under version control with the Angular 22 +
  Material UI from demo-monolith; stop committing the built static/ folder
- Serve the UI from nginx, which proxies /api to the backend so the JWT
  cookie works on a single origin, and falls back to index.html for routes

Backend
- Add PUT /api/users/{id}/roles (admin only) that keeps at least one admin
  and does not let an admin drop their own admin role
- Tighten security: read tutorials publicly, change them only when logged
  in, users/roles API for admins only; hide password hashes in JSON
- Remove unused Settings and Test endpoints, DTO mappers, commented code
- Flyway V2 aligns the schema with the entities; Hibernate now runs with
  ddl-auto: validate
- JWT lifetime matches the 24h cookie; fix the cookie name typo
- Keep CORS only for calling the API directly (ng serve without proxy)

Docker
- Backend Dockerfile: Gradle build + JRE runtime with layer caching,
  non-root user and healthcheck; add .dockerignore
- UI Dockerfile: Node 24 build + nginx with healthcheck
- docker-compose runs its own Postgres, starts services in health order
  and always rebuilds images

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -1,28 +1,58 @@
 services:
+  demo-decoupled-postgres:
+    image: postgres:16-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: jambotron_decoupled
+      POSTGRES_USER: jambotron_admin
+      POSTGRES_PASSWORD: jambo_secret_pass
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U jambotron_admin -d jambotron_decoupled"]
+      interval: 3s
+      timeout: 3s
+      retries: 5
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    networks:
+      - demo-decoupled
+
   backend:
     build: .
-    container_name: decoupled_backend
+    # Собирать образ при каждом `docker compose up`, иначе compose молча запускает старый образ
+    pull_policy: build
+    restart: unless-stopped
+    # Ждём, пока база начнёт принимать подключения, иначе Flyway падает на старте
+    depends_on:
+      demo-decoupled-postgres:
+        condition: service_healthy
     ports:
       - "8080:8080"
     environment:
-      - SPRING_DATASOURCE_URL=jdbc:postgresql://jambo-postgres:5432/jambotron_decoupled
-      - SPRING_DATASOURCE_USERNAME=jambotron_admin
-      - SPRING_DATASOURCE_PASSWORD=jambo_secret_pass
-      - SPRING_DATASOURCE_DRIVER-CLASS-NAME=org.postgresql.Driver
-      - SPRING_FLYWAY_URL=jdbc:postgresql://jambo-postgres:5432/jambotron_decoupled?options=-c%20timezone=UTC
-      - SPRING_FLYWAY_USER=jambotron_admin
-      - SPRING_FLYWAY_PASSWORD=jambo_secret_pass
+      SPRING_DATASOURCE_URL: jdbc:postgresql://demo-decoupled-postgres:5432/jambotron_decoupled?options=-c%20timezone=UTC
+      SPRING_DATASOURCE_USERNAME: jambotron_admin
+      SPRING_DATASOURCE_PASSWORD: jambo_secret_pass
+      # В application.yaml Flyway настроен на localhost отдельно от datasource — переопределяем
+      SPRING_FLYWAY_URL: jdbc:postgresql://demo-decoupled-postgres:5432/jambotron_decoupled?options=-c%20timezone=UTC
+      SPRING_FLYWAY_USER: jambotron_admin
+      SPRING_FLYWAY_PASSWORD: jambo_secret_pass
     networks:
-      - jambotron-net
+      - demo-decoupled
 
   frontend:
     build: ./spring-angular-ui
-    container_name: decoupled_frontend
+    pull_policy: build
+    restart: unless-stopped
+    # nginx проксирует /api на backend — без него UI не работает
+    depends_on:
+      backend:
+        condition: service_healthy
     ports:
       - "8081:80"
     networks:
-      - jambotron-net
+      - demo-decoupled
+
+volumes:
+  postgres_data:
 
 networks:
-  jambotron-net:
-    external: true
+  demo-decoupled: