feat: rewrite backend in Java

[JackCC703]

What changed

• add a Java 21 / Spring Boot 4.1 backend for PR-description generation
• move GitHub Diff fetching, truncation, prompt construction, AI requests, retry logic, and error handling out of the browser extension
• keep the extension focused on configuration, preview, and GitHub textarea injection
• add optional backend access-token protection and optional GitHub token support for private repositories
• add Docker Compose, backend tests, CI, updated packaging workflow, and complete setup/deployment documentation
• remove the generated TypeScript build-info file from version control

Why

The previous browser-only implementation stored the AI API key locally and sent Diff content directly to the configured model provider. Centralizing these responsibilities in a Java backend keeps model credentials server-side and gives the project one place to manage prompts, retries, validation, and team-wide configuration.

User and developer impact

• users must start or deploy the Java backend and configure its URL in the extension
• AI provider settings now come from backend environment variables
• the extension no longer stores the AI API key, model, or provider URL
• public repositories work without a GitHub token; private repositories can use GITHUB_TOKEN
• deployed backends can be protected with APP_SECURITY_TOKEN

Validation

• mvn --batch-mode --no-transfer-progress clean verify — 9 tests passed
• npm run build
• tsc --noEmit --incremental false
• npm run package
• docker compose config
• Spring Boot JAR smoke tests for health, token authorization, validation errors, and GitHub URL allowlisting
• SVG/XML validation and staged secret scan

A live model completion was not run because no real AI API key was placed in the project or test environment.