Production readiness, security hardening, and refresh token rotation

[mfarim]

Summary of Changes

This pull request addresses critical security vulnerabilities, implements token renewal mechanisms, improves production observability, and establishes open-source governance standards for the Spring Boot & React E-Learning/CBT platform.

---

Security Hardening

• Path Traversal Protection (FileStorageService): Added path normalization and directory boundary validation to ensure stored, retrieved, or deleted files cannot escape the base upload root directory. Returns HTTP 403 Forbidden on unauthorized file traversal attempts.
• Sanitized Global Error Responses (GlobalExceptionHandler): Removed generic exception leak (ex.getMessage()) to prevent internal database queries, table names, or connection credentials from leaking to clients. Exceptions are now logged to the server while returning a safe client message.
• Synchronized JWT Secret Configuration: Standardized environment variables in docker-compose.yml (JWT_SECRET and APP_JWT_SECRET) to ensure proper 256-bit Base64 parsing matching JwtProvider.

---

Authentication & UX Enhancements

• Refresh Token Endpoint (/api/v1/auth/refresh): Implemented endpoint allowing clients to exchange valid refresh tokens for new access and refresh tokens without interrupting user sessions.
• Client-Side Silent Token Refresh: Updated the Axios response interceptor in frontend/src/api/client.ts to automatically detect HTTP 401 Unauthorized, queue concurrent requests, obtain a new access token via /api/v1/auth/refresh, and replay original requests seamlessly. This prevents students from being prematurely logged out during lengthy CBT exams.

---

DevOps & Observability

• Spring Boot Actuator Integration: Added spring-boot-starter-actuator with health probes exposed under /actuator/health and /actuator/info.
• Docker Compose Health Checks: Added a health check for the backend service and updated the frontend container to wait until the backend is healthy before serving traffic.
• Persistent File Storage: Added the backend_storage volume mount (/app/storage/uploads) in docker-compose.yml to prevent loss of uploaded assignments and learning materials across container restarts.
• Nginx Reverse Proxy: Added /actuator/ routing support in frontend/nginx.conf.

---

Open Source Governance & Documentation

• Added MIT License (LICENSE): Officially licensed the project under the MIT License as indicated by the README badge.
• Added CONTRIBUTING.md: Created detailed onboarding guidelines covering local prerequisites, Docker setup, coding conventions, testing procedures, and security reporting.
• Demo Seeding Instructions: Updated README.md and README.id.md with instructions on how to seed realistic demo data (seed_demo_data.sql) into PostgreSQL via Docker.

---

Testing & Verification

• Backend Unit Tests: Added unit tests for FileStorageService (testing traversal attacks) and JwtProvider (testing token rotation and invalid signatures).

  mvn test -Dtest=FileStorageServiceTest,JwtProviderTest
  # Results: Tests run: 8, Failures: 0, Errors: 0, Skipped: 0 (BUILD SUCCESS)