Regenerate course deltas for .NET 10 + Boot 4.1 secure modernization

[GeekTrainer]

What & why

Re-baselines the ACC learner-branch delta store onto the current main app state and rewrites Module 6 to the secure currency upgrade. main already carries .NET 10 (#34) and the CVE-clean Boot 3.5.16 / Java 17 Java baseline (#36); this PR makes the start-of-module-N deltas regenerate cleanly on that state and moves the Module 6 exercise from the old (now-impossible) Boot 2.7→3.5 story to a real, zero-CVE Boot 3.5.16/Java 17 → Boot 4.1.0/Java 21 modernization.

PR-only. No promotion is performed. No start-of-module-*, regen/*, or acc-* refs are pushed; the acc-base tag is not moved. Promotion (moving mutable aliases + the acc-base tag to the new base) remains a gated, owner-approved step.

Net change (main tree)

Only course-build/** and .github/workflows/validate-branches.yml change on main. No app/service files are modified on main — the Boot 4.1 modernization lives inside the Module 6 delta and only materializes on the built start-of-module-07 learner branch.

New tooling-free base commit C

manifest.base.sha: 3689288 → 510b4ff (grafted into this branch's history via an -s ours merge so CI's fetch-depth: 0 has the object; the branch tree is unchanged). C = acc-base's pristine, tooling-free file-set updated to main's current app state (net10 assets-svc + Boot 3.5.16/Java 17 services); no course-build/ or workflow automation.

Deltas re-authored / re-verified against C (all expectedTreeSha recomputed)

• module-01 — README reconciled: keep current facts (.NET 10, React islands) + the ARCHITECTURE.md / gap-fill additions.
• module-02, 04 — apply unchanged.
• module-03 — root package.json/package-lock regenerated (Playwright + concurrently 10.x); reporting-svc pyproject test-deps merged with dependabot versions.
• module-05 — assets-svc.csproj reconciled to .NET 10 package versions + the Net.Codecrete.QrCodeGenerator dependency.
• module-06 — REWRITTEN to the secure modernization (details below).

Module 6 — the rewritten "after"

audit-svc + auth-svc: Boot 3.5.16 → 4.1.0, Java 17 → 21, Dockerfiles temurin 17 → 21, plus currency pins because Boot 4.1.0 natively resolves a vulnerable Jackson 3 (3.1.4) and Log4j2 (2.25.4). auth-svc additionally migrates jjwt 0.11.5 → 0.12.7 (fluent builder API in JwtIssuer) and swaps jjwt-jackson → jjwt-gson so JWT (de)serialization stays off Jackson 2, which Boot 4 no longer manages. The javax→jakarta rename and with-java11 removal are already pre-done on the base, so they're no longer part of this delta.

Verification (real builds, JDK 21 / Temurin 21.0.12)

• mvn verify green: audit-svc 3/3, auth-svc 4/4 on Boot 4.1.0/Java 21 (incl. a token round-trip proving the gson serializer under Jackson 3). Tests use @LocalServerPort + RestClient to avoid the Boot 4 TestRestTemplate relocation.
• OSV zero-vuln: every resolved artifact across both services (all scopes) — the auth-svc tree confirms no com.fasterxml.jackson.core:jackson-databind (Jackson 2) remains.
• build-branches.mjs --check: all 6 module trees match manifest, ancestry linear. selftest.mjs: green.

Pinned final version set (for the ACC content reconcile / PR #20 TODOs)

Coordinate	Value
Spring Boot	4.1.0
Java	21
Spring Framework	7.0.8
Tomcat embed	11.0.22
Jackson 3 (tools.jackson, pinned jackson-bom.version)	3.1.6
Log4j2 API (pinned log4j2.version)	2.25.5
jjwt (api/impl/gson)	0.12.7
gson (via jjwt-gson)	2.13.2

("Before" baseline on main, for reference: Boot 3.5.16 / Java 17 / jackson-bom 2.22.2 / log4j2 2.25.5.)

CI

validate-branches.yml: setup-dotnet 8.0 → 10.0; Java matrix collapsed to a single Java 21 (drop the Java 11 leg). validate-branch.sh drops the with-java11 wrapper (all Java services now build on JDK 21; audit/auth target 17 bytecode before Module 6, 21 after).

⚠️ Promotion still required (gated, owner-approved)

This PR only updates the delta store + CI. After merge, a separate gated promotion must build the staging refs, move the mutable start-of-module-* aliases, cut the acc-<month> tags, and move the acc-base tag to 510b4ff. promote-branches is not run here.

Companion (not in this PR)

The ACC content rewrite (content/06 + resources/modernize-audit-svc.md) and the exhaustive docs/modernization/* pedagogy reconcile are tracked for the ACC content PR (#20) using the pinned versions above.