Upgrade/spring boot3 jdk25

[GSAlex]

upgrade to Spring Boot 3.5.11 + JDK 25

• Spring Boot 2.6.14 → 3.5.11, Java 11 → 25
• javax.persistence/servlet/validation → jakarta.*
• Springfox → Springdoc OpenAPI
• Custom SQLiteDialect → hibernate-community-dialects
• Spring Security 6.x lambda DSL (requestMatchers)
• Logback: fix springProfile nesting + %M() pattern
• Restore ant_path_matcher for SPA routing
• Dockerfiles updated to eclipse-temurin:25
• Lombok 1.18.44, SQLite-JDBC 3.51.3.0

Verified the server build, tests, package output, Docker image startup and normal usage.
已验证服务端构建、测试、打包产物以、 Docker 镜像启动及正常使用。

[augmentcode]

🤖 Augment PR Summary

Summary: Upgrades the Huntly server stack to Spring Boot 3.5.11 and JDK 25, modernizing the framework baseline and aligning the codebase with Jakarta EE APIs.

Changes:

• Upgraded Spring Boot 2.6.14 → 3.5.11 and Java 11 → 25 across the multi-module Maven build.
• Migrated `javax.*` (servlet/validation/persistence) imports to `jakarta.*` throughout interfaces, JPA, and server modules.
• Replaced Springfox (Swagger) with Springdoc OpenAPI; removed the old `DocketConfig` and added a Springdoc `OpenAPI` bean.
• Removed the custom SQLite dialect/initializer and switched Hibernate to `hibernate-community-dialects` with `org.hibernate.community.dialect.SQLiteDialect` configured.
• Updated Spring Security configuration to the Spring Security 6 lambda DSL using `requestMatchers`.
• Adjusted Logback configuration (profile scoping + method token) and kept Ant-style path matching for SPA forwarding.
• Updated Docker build/runtime images to Eclipse Temurin 25.

Technical Notes: This is a large baseline upgrade; dialect and security matcher behavior changes are the primary areas to re-validate during rollout.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

[augmentcode]

.anyRequest().permitAll() makes every non-/api/** endpoint publicly accessible; please double-check there aren’t any sensitive or state-changing controllers mounted outside the /api namespace (e.g., management endpoints) that should remain authenticated.

Severity: medium

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}