build(server): upgrade to Spring Boot 4 (Jackson 3, Framework 7)

[JinBa1]

Upgrades the server module from Spring Boot 3.4.1 to 4.0.7, the prerequisite for upcoming Spring AI 2.x MCP integration (which requires Boot 4). Scoped to the server module only — the engine module stays Spring-free and on Java 17, and its 419 tests plus the 20 byte-identical sample queries are untouched.

Changes

• spring-boot 3.4.1 → 4.0.7; springdoc-openapi 2.7.0 → 3.0.3 (the Boot-4 / Jackson-3 line).
• spring-boot-starter-web → spring-boot-starter-webmvc (deprecated rename in Boot 4).
• @WebMvcTest moved to org.springframework.boot.webmvc.test.autoconfigure; added spring-boot-starter-webmvc-test.
• TestRestTemplate relocated to org.springframework.boot.resttestclient and no longer auto-configured under @SpringBootTest: added the dependency + @AutoConfigureTestRestTemplate, plus spring-boot-restclient (not pulled transitively, Boot #48588).
• HttpHeaders.containsKey() removed in Framework 7 → containsHeader().
• Migrated test JSON parsing to Jackson 3 (tools.jackson.databind, asString()) so it no longer relies on a transitive Jackson 2.
• Synced the README / AGENTS server section to the live Spring Boot gateway.

Notes

• Java baseline stays 17 (Boot 4 minimum is 17). The non-reparent BOM strategy (module keeps its own parent, imports spring-boot-dependencies) is retained.

Verification

mvn clean test green across both modules: engine 419 + server 52, 0 failures / 0 skips. The 4 RANDOM_PORT integration tests exercise a real embedded Tomcat 11 over HTTP and assert identical response bodies and status codes.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[JinBa1]

@claude review this PR

[claude]

Claude finished @JinBa1's task in 1m 29s —— View job

---

PR Review: build(server): upgrade to Spring Boot 4 (Jackson 3, Framework 7)

• Read repo guidelines
• Review server/pom.xml changes
• Review test file changes
• Review documentation changes
• Post comprehensive review feedback

---

Overall

This is a clean, well-scoped upgrade. The changes are mechanically correct across all migration axes (package renames, API renames, new test starters), the PR notes document non-obvious workarounds with references to specific Boot issues, and the CI is green across both modules. Approachable to merge as-is — observations below are mostly notes for awareness.

---

server/pom.xml

Correct:

• BOM-managed versions for all org.springframework.boot artifacts — no explicit <version> needed on spring-boot-resttestclient / spring-boot-restclient since spring-boot-dependencies covers them.
• Retaining the non-reparent BOM strategy (dependencyManagement import rather than <parent> reparent) is right — it preserves the structural boundary between cuckoodb-parent and Spring.
• spring-boot-starter-webmvc rename from spring-boot-starter-web is the correct Boot 4 change.
• Three separate test dependencies (spring-boot-starter-webmvc-test, spring-boot-resttestclient, spring-boot-restclient) all scoped test — correct.

One observation — pom comments are commit-message density, not maintenance comments:
The inline XML comments (e.g. the springdoc block) read more like a PR description than something a future maintainer needs to see inside pom.xml. Referencing springdoc #3163 and Boot #48588 inline is useful for traceability today, but those issue numbers will be meaningless without context in 18 months. Consider trimming to a single-line rationale per non-obvious dependency and letting the commit/PR carry the detailed story. That said, over-commenting a migration is a very minor sin.

---

Test files — Jackson 3 migration

All asText() → asString() calls and com.fasterxml.jackson → tools.jackson imports are consistently migrated across every integration test that touches JSON parsing:

File	asText() calls migrated	Import migrated
BudgetIntegrationTest	3 ✓	✓
QueryApiIntegrationTest	5 ✓	✓
UploadApiIntegrationTest	5 ✓	✓
UploadLimitIntegrationTest	1 ✓	✓

No missed asText() calls or stale com.fasterxml imports. Good.

---

Test files — TestRestTemplate relocation

@AutoConfigureTestRestTemplate is correctly added to all 4 RANDOM_PORT integration tests. The import path org.springframework.boot.resttestclient.autoconfigure.AutoConfigureTestRestTemplate is the right Boot 4 location.

One forward-looking note: Spring Boot 4 introduced RestTestClient as the preferred successor to TestRestTemplate (fluent API, no deprecated path). Keeping TestRestTemplate for this upgrade is a perfectly reasonable behaviour-preserving choice — but a follow-up migration to RestTestClient would avoid living on the legacy client indefinitely.

---

HttpHeaders API

containsKey("Retry-After") → containsHeader("Retry-After") in BudgetIntegrationTest:72 and UploadLimitIntegrationTest:69 — correct, this is the Framework 7 API replacement.

---

@WebMvcTest package

org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest → org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest in QueryControllerTest and TableControllerTest — correct.

---

Production code

No changes to server/src/main/java. This is expected: the production controllers use Spring MVC's message converters for Jackson serialisation (no direct Jackson imports needed in controller code), so Boot 4's bundled Jackson 3 is picked up transparently.

---

Documentation

AGENTS.md and README.md are correctly updated to reflect that the server module is now a working REST gateway rather than a skeleton. The tree entries are accurate.

---

Summary

No bugs, no security issues, no missing migrations spotted. The two items worth noting for follow-up:

1. Trim pom.xml inline comments — issue numbers belong in git history, not XML. Minor.
2. RestTestClient migration — TestRestTemplate works, but RestTestClient is the Boot 4 idiomatic choice for a cleaner future.

Neither of these blocks the merge.