fix: resolve top 5 SonarQube issues (weekly sweep)

[devin-ai-integration]

Summary

Weekly SonarQube code quality sweep resolving the top 5 open issues ranked by severity, type, effort, and recency.

Issues Fixed

#	SonarQube Key	Severity	Type	File	Description	Fix
1	AZ1u3HBdEnUkF3fpjVtN	CRITICAL (HIGH)	BUG	InvalidRequestException.java	Non-serializable Errors field in serializable exception class (rule java:S1948)	Made errors field transient
2	AZ1u3HCaEnUkF3fpjVtj	CRITICAL (HIGH)	CODE_SMELL	ArticleApi.java:36	Generic wildcard type ResponseEntity<?> in return type (rule java:S1452)	Replaced with ResponseEntity<Map<String, Object>>
3	AZ1u3HCaEnUkF3fpjVtk	CRITICAL (HIGH)	CODE_SMELL	ArticleApi.java:45	Generic wildcard type ResponseEntity<?> in return type (rule java:S1452)	Replaced with ResponseEntity<Map<String, Object>>
4	AZ1u3HBkEnUkF3fpjVtQ	CRITICAL (HIGH)	CODE_SMELL	CommentsApi.java:41	Generic wildcard type ResponseEntity<?> in return type (rule java:S1452)	Replaced with ResponseEntity<Map<String, Object>>
5	AZ1u3HCpEnUkF3fpjVtq	MAJOR (MEDIUM)	RELIABILITY	JwtTokenFilter.java:20-21	Field injection via @Autowired instead of constructor injection (rule java:S6813)	Converted to constructor injection; updated WebSecurityConfig accordingly

Review & Testing Checklist for Human

• Verify the transient keyword on InvalidRequestException.errors doesn't affect exception handling (it shouldn't — the field is only accessed in-process via getErrors(), never serialized)
• Verify the ResponseEntity<Map<String, Object>> return types don't break any REST API contract (these are the same runtime types, just more specific at compile time)
• Verify the constructor injection refactor in JwtTokenFilter and WebSecurityConfig doesn't affect Spring bean wiring — run ./gradlew bootRun and test authentication endpoints

Notes

• ./gradlew spotlessCheck fails on master with a pre-existing JVM module access error (IllegalAccessError in Google Java Format). This is not related to these changes.
• All 68 tests pass locally with ./gradlew test.
• SonarQube project key: choikh0423_demo-spring-boot-test-coverage (265 total open issues; 0 BLOCKER, 4 CRITICAL/HIGH, remainder MEDIUM/LOW).

Link to Devin session: https://app.devin.ai/sessions/2672ef386ae44c61b3ac0066ff0995c5
Requested by: @choikh0423

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

💡 Connect your GitHub account to enable automatic code reviews.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.