[shrish-browserstack]

Stacks on #7 — merge that first

This branch is built on fix/build-and-ci (PR #7). Until #7 merges, the diff below also shows #7's two commits; once it does, this PR collapses to just the foundation work. Part 2 of the overhaul plan; the trade math is untouched here.

What

Schema is now owned by Flyway

• flyway-core + flyway-mysql; Hibernate switched to ddl-auto: validate.
• db/migration/V1__baseline.sql reproduces exactly the schema Hibernate had been generating (captured from a live ddl-auto database).
• Existing databases are adopted automatically (baseline-on-migrate, baseline-version: 1) — no manual step for anyone already running it.

Profiles & externalized config

• application.yaml → application.yml + application-dev.yml + application-prod.yml. dev is the default locally (SQL echo on, seed endpoints enabled); deployments set SPRING_PROFILES_ACTIVE=prod.
• Everything comes from the environment with sane defaults: MYSQL_HOST/PORT/DATABASE|DB/USER/PASSWORD, KAFKA_BOOTSTRAP_SERVERS (the compose/k8s name KAFKA_ADVERTISED_LISTENERS is still honored), STOCK_SHEET_URL, STOCK_PRICE_CRON.
• The hardcoded LAN IP 172.16.97.42 is gone from application.yaml, Dockerfile, docker-compose.yaml, and KafkaConfig.
• open-in-view: false, Hikari pool sizing, Kafka bootstrap gets a default instead of failing on a missing env var.
• The not-yet-wired trade consumer is gated behind app.kafka.consumer-enabled (default false) via @KafkaListener(autoStartup=…). ⚠️ Gotcha worth knowing: spring.kafka.listener.auto-startup does not exist in Spring Boot 3.0.2 (added in 3.1) and is silently ignored — I hit this during verification; the per-listener attribute is the switch that actually works.

Stock ingestion

• StockServiceImpl: a single parse path (commons-csv, which was a declared-but-unused dependency) shared by the upload endpoint and the scheduled download. Rows upsert by stock name instead of inserting duplicates on every import; header / short / blank rows are skipped rather than aborting; one batched saveAll; HTTP client with connect + read timeouts; failures are logged with context instead of printStackTrace. The near-duplicate updateStocksFromCsv is removed.
• The @Scheduled price refresh moves out of PortfolioController into StockPriceScheduler.

HTTP semantics

• PopulateDatabaseController: the three DB-mutating GETs are now POSTs, and the whole controller is @Profile("dev") — seeders can't reach production.
• PortfolioController: removed the redundant @Controller, the unreachable duplicate null-check, unused imports.

Cleanup

• Deleted dead Demo.java. Removed jacoco declared as a runtime dependency (the plugin stays), and unused deps okhttp, quartz, commons-io 1.3.2 (2007), java-dotenv. mysql-connector-java → com.mysql:mysql-connector-j. Pinned spring-boot-maven-plugin (was unversioned). -parameters enabled, which silences the repository LocalVariableTable fallback warnings at boot.
• Dockerfile carries only app settings (dropped the broker env vars and the baked MYSQL_ROOT_PASSWORD). README: populate endpoints corrected, k8s manifest path fixed, new Configuration & Schema section.

Verification (local MySQL 8)

Check	Result
mvn verify	green — 28 tests, 0 failures (was 27; the consolidated CSV path gained header/short-row and upsert tests)
Existing ddl-auto database, first boot	Flyway created flyway_schema_history and recorded V1 as BASELINE; Hibernate validate passed; app started in 2.5 s
Fresh empty database, prod profile	V1 applied as SQL, all tables created, validate passed
prod gating	POST /api/populate/users → 404; SQL echo lines in log: 0
dev default	POST /api/populate/users → 200; old GET verb → 405
Trade flow regression	POST /api/trade → 200, GET /api/portfolio/1 → 200
CSV upsert (POST /api/stocks/update)	Stock1 updated in place (same id, close_price 999), NewCo inserted — no duplicate rows
Boot noise	Kafka consumer connection warnings: 0 (were 10 per boot)

Known and deliberately left for the next PRs: the empty-portfolio "totalPLPercentage":"NaN" (fixed with the real aggregation algorithm in the portfolio PR), Double money (domain PR), Kafka wiring (outbox PR). Also left alone: the explicit jackson-databind 2.15.2 override and the deprecated openjdk:17-jdk-slim base image.

🤖 Generated with Claude Code