fix: harden auth and public share links

[Heyaaz]

Summary

• block OAuth dev fallback unless explicitly enabled for local/test use
• require JWT secret configuration and move cookie Secure handling to environment/profile config
• replace public schedule/TPTI share lookup by sequential IDs with random share tokens
• add Flyway migration and auth security unit coverage

Verification

• ./gradlew compileKotlin compileTestKotlin
• ./gradlew test --tests 'com.tripsync.application.auth.SecurityConfigurationUnitTest'

Notes

• Full ./gradlew test still requires Docker/Testcontainers. Local Docker daemon was not running, so DB-backed integration tests cannot complete in this environment.
• Public share URLs now require shareToken; frontend callers that build /share/schedules/{id} or /share/tpti/{id} need to use the returned shareToken.

[Heyaaz]

Nogada PR Review

Verdict: ✅ 통과

Blocking issues: 없음

Notes:

• 전체 clean test는 현재 에이전트 환경에서 Docker/Testcontainers provider를 찾지 못해 Spring context 계열 테스트가 실행 전 실패했습니다. PR 코드 실패로 보이진 않고 환경 제한으로 판단했습니다.
• 대신 fresh detached worktree에서 컴파일과 변경 범위 단위 테스트를 별도로 확인했습니다.

Checked scope:

• Auth hardening: JWT secret 검증, OAuth dev fallback 차단, secure cookie 설정, auth error status 계약
• Public share links: schedule/TPTI share token 엔티티·repository·controller·migration 흐름
• Response mapper: shareToken 노출, public share payload, external image/popularity metadata
• Persona validation copy 변경 및 테스트
• Hygiene: git diff --check origin/main...pr-25 통과

Verification:

• git diff --check origin/main...pr-25 ✅
• ./gradlew compileKotlin compileTestKotlin --no-daemon --no-build-cache ✅
• ./gradlew test --tests 'com.tripsync.application.auth.SecurityConfigurationUnitTest' --tests 'com.tripsync.application.persona.PersonaValidationServiceTest' --tests 'com.tripsync.application.schedule.ScheduleResponseMapperTest' --no-daemon --no-build-cache ✅ — 14 tests, 0 failures/errors
• ./gradlew clean test --no-daemon --no-build-cache ⚠️ 환경 제한: Testcontainers Docker provider 없음