feat: finish demo — port demo-monolith cleanup, separate UI and API containers

Frontend
- Bring spring-angular-ui back under version control with the Angular 22 +
  Material UI from demo-monolith; stop committing the built static/ folder
- Serve the UI from nginx, which proxies /api to the backend so the JWT
  cookie works on a single origin, and falls back to index.html for routes

Backend
- Add PUT /api/users/{id}/roles (admin only) that keeps at least one admin
  and does not let an admin drop their own admin role
- Tighten security: read tutorials publicly, change them only when logged
  in, users/roles API for admins only; hide password hashes in JSON
- Remove unused Settings and Test endpoints, DTO mappers, commented code
- Flyway V2 aligns the schema with the entities; Hibernate now runs with
  ddl-auto: validate
- JWT lifetime matches the 24h cookie; fix the cookie name typo
- Keep CORS only for calling the API directly (ng serve without proxy)

Docker
- Backend Dockerfile: Gradle build + JRE runtime with layer caching,
  non-root user and healthcheck; add .dockerignore
- UI Dockerfile: Node 24 build + nginx with healthcheck
- docker-compose runs its own Postgres, starts services in health order
  and always rebuilds images

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

spring-angular-ui/src/app/services/auth.service.ts

@@ -2,7 +2,8 @@ import { Injectable } from '@angular/core';
 import { HttpClient, HttpHeaders } from '@angular/common/http';
 import { Observable } from 'rxjs';
 
-const AUTH_API = 'http://localhost:8080/api/auth/';
+// Используем относительный путь вместо хардкода http://localhost:8080/api/auth/
+const AUTH_API = '/api/auth/';
 
 const httpOptions = {
   headers: new HttpHeaders({ 'Content-Type': 'application/json' })

spring-angular-ui/src/app/services/roles.service.ts

@@ -3,7 +3,8 @@ import { HttpClient } from '@angular/common/http';
 import { Observable } from 'rxjs';
 import { Role } from '../models/role';
 
-const API_URL = 'http://localhost:8080/api/roles';
+// Используем относительный путь вместо хардкода http://localhost:8080/api/roles
+const API_URL = '/api/roles';
 
 
 @Injectable({

spring-angular-ui/src/app/services/token-storage.service.ts

@@ -1,6 +1,5 @@
 import { Injectable } from '@angular/core';
 
-const TOKEN_KEY = 'auth-token';
 const USER_KEY = 'auth-user';
 
 @Injectable({
@@ -9,19 +8,6 @@ const USER_KEY = 'auth-user';
 export class TokenStorageService {
   constructor() { }
 
-  signOut(): void {
-    window.sessionStorage.clear();
-  }
-
-  public saveToken(token: string): void {
-    window.sessionStorage.removeItem(TOKEN_KEY);
-    window.sessionStorage.setItem(TOKEN_KEY, token);
-  }
-
-  public getToken(): string | null {
-    return window.sessionStorage.getItem(TOKEN_KEY);
-  }
-
   public saveUser(user: any): void {
     window.sessionStorage.removeItem(USER_KEY);
     window.sessionStorage.setItem(USER_KEY, JSON.stringify(user));

spring-angular-ui/src/app/services/tutorial.service.ts

@@ -3,7 +3,8 @@ import { HttpClient } from '@angular/common/http';
 import { Observable } from 'rxjs';
 import { Tutorial } from '../models/tutorial.model';
 
-const baseUrl = 'http://localhost:8080/api/tutorials';
+// Используем относительный путь вместо хардкода http://localhost:8080/api/tutorials
+const baseUrl = '/api/tutorials';
 
 @Injectable({
   providedIn: 'root'
@@ -36,6 +37,10 @@ export class TutorialService {
     return this.http.delete(baseUrl);
   }
 
+  getPublished(): Observable<Tutorial[]> {
+    return this.http.get<Tutorial[]>(`${baseUrl}/published`);
+  }
+
   findByTitle(title: any): Observable<Tutorial[]> {
     return this.http.get<Tutorial[]>(`${baseUrl}?title=${title}`);
   }

spring-angular-ui/src/app/services/user.service.ts

@@ -2,9 +2,9 @@ import { Injectable } from '@angular/core';
 import { HttpClient } from '@angular/common/http';
 import { Observable } from 'rxjs';
 import {User} from "../models/user.model";
-import {Tutorial} from "../models/tutorial.model";
 
-const API_URL = 'http://localhost:8080/api/users';
+// Используем относительный путь вместо хардкода http://localhost:8080/api/users
+const API_URL = '/api/users';
 
 @Injectable({
   providedIn: 'root'
@@ -12,20 +12,11 @@ const API_URL = 'http://localhost:8080/api/users';
 export class UserService {
   constructor(private http: HttpClient) { }
 
-  getPublicContent(): Observable<any> {
-    return this.http.get(API_URL + '/all', { responseType: 'text' });
-  }
-
-  getUserBoard(): Observable<any> {
-    return this.http.get(API_URL + '/user', { responseType: 'text' });
-  }
-
-  getModeratorBoard(): Observable<any> {
-    return this.http.get(API_URL + '/mod', { responseType: 'text' });
-  }
-
-  getAdminBoard(): Observable<User[]> {
+  getAll(): Observable<User[]> {
     return this.http.get<User[]>(API_URL);
   }
-}
 
+  updateRoles(id: any, roles: string[]): Observable<User> {
+    return this.http.put<User>(`${API_URL}/${id}/roles`, { roles });
+  }
+}