Spring Boot 4 migration — blocks #134 and cross-repo dep bumps

[amavashev]

Tracks the Spring Boot 3.x → 4.x migration in `cycles-server`. Currently blocks #134 and is the peer of `runcycles/cycles-server-admin#156`.

Why this isn't a Dependabot merge

The Dependabot bump (#134) from `spring-boot-starter-parent` 3.5.14 → 4.0.6 is a major version jump. SB4 changes:

• Java 17 → 21 baseline (this repo is already on Java 21, so OK)
• Servlet 6 / Jakarta EE 10 surface
• Project Loom virtual-thread defaults (SB4 enables them in some configs by default)
• Package moves — e.g., `ErrorMvcAutoConfiguration` from `autoconfigure.web.servlet` → `webmvc.autoconfigure` (this is the same package move that breaks Springdoc 3 in `cycles-server-admin#152`)
• Spring Data Redis baseline change — verify alongside the Jedis 7.5.0 we just landed in chore(deps): bump redis.clients:jedis from 6.2.0 to 7.5.0 in /cycles-protocol-service #136

The PR's CI fails on Build & Test, Integration (with contract validation), and scan — all expected for a major version bump that lacks the surrounding migration work.

Scope of the migration

• Bump `spring-boot-starter-parent` 3.5.x → 4.0.x in `cycles-protocol-service/pom.xml`
• Re-test reservation Lua scripts and JedisPool wiring (already on Jedis 7 from chore(deps): bump redis.clients:jedis from 6.2.0 to 7.5.0 in /cycles-protocol-service #136 — that ground was already broken)
• Re-validate every endpoint against the OpenAPI contract test
• Run benchmarks (per release-workflow convention) — SB4 virtual-thread changes may shift latency tail
• AUDIT.md / CHANGELOG.md / OPERATIONS.md / README.md / BENCHMARKS.md — five-doc release per memory `feedback_release_workflow`
• Coordinate with `cycles-server-admin` (chore: org-wide hygiene bundle (#60 + #62 + #63) #156) and `cycles-server-events` so all three flip together; mixed SB3 ↔ SB4 in production should be avoided

Cross-repo

• `cycles-server-admin` peer: Spring Boot 4 migration — blocks Springdoc 3 (#152) cycles-server-admin#156
• `cycles-server-events` will need a companion bump — currently still on SB 3.5.14, no tracking issue yet.

Reference

• PR chore(deps): bump org.springframework.boot:spring-boot-starter-parent from 3.5.14 to 4.0.6 in /cycles-protocol-service #134 (closed): chore(deps): bump org.springframework.boot:spring-boot-starter-parent from 3.5.14 to 4.0.6 in /cycles-protocol-service #134
• Downstream blocker: `cycles-server-admin#152` (Springdoc 3, requires SB4 first)