Enforce "self or admin" authorization on PATCH /users/{id}

[Copilot]

Any authenticated user could modify another user's username, email, name, or bio by targeting their id — only the role/accountNonLocked fields had an admin guard.

Changes

• Auth.java — Added USER_SELF_OR_ADMIN SpEL constant, mirroring the existing REVIEW_OWNER_OR_ADMIN pattern:

  public static final String USER_SELF_OR_ADMIN =
      "@userService.isSelf(#id, authentication.principal.username) or hasRole('ADMIN')";

• UserService — Added isSelf(UUID id, String username) authorization helper (mirrors ReviewService.isOwner)
• UserController — Added @PreAuthorize(USER_SELF_OR_ADMIN) to PATCH /users/{id}

The existing admin-only guard inside update() for role/accountNonLocked is retained — users cannot elevate their own role or toggle their lock status.

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.