build(sonar): tune quality gate for false positives and fix genuine findings

[wolpert]

What

Tunes the SonarCloud quality gate that went red on the first analysis, and fixes the genuine findings behind it.

The red gate was an onboarding artifact, not a regression. Overall code health already passes every threshold (coverage 88.3%, duplication 2.3%); the gate only failed on new_* conditions, where the first analysis scored a non-representative slice of the backlog against strict Clean-as-You-Code thresholds. All 407 issues were triaged; the headline counts were dominated by rules that conflict with this project's conventions, not by defects.

Changes

Config (build.gradle.kts, documented in ADR 0017):

• Suppress java:S4449 project-wide — it demands JSR-305 javax.annotation.Nullable; we standardize on JSpecify, enforced by Error Prone (CONTRIBUTING.md §7).
• Suppress java:S2699 on **/*Test.java — the persistence/in-memory suites delegate assertions to shared testkit *Scenarios classes so one suite runs against every backend; the rule can't see across the call. Test effectiveness is already gated by JaCoCo floors + mutation testing.
• Exclude DynamoDB *Item beans and module-info.java from coverage — mandatory SDK-driven POJOs / no executable statements.

Genuine code fixes:

• Annotate Micronaut admin controller @Body params @Nullable, matching the Spring adapter. Micronaut can inject a null body, so the existing body == null guards are correct — this clears the S2583/S2589 "dead condition" cluster the right way instead of deleting the guards.
• CeremonyScenarios: Optional.orElseThrow() instead of get() (S3655).

Deliberately not done (would be number-chasing)

Defensive jti == null guards, Spring getPrincipal() (returns a non-null final field), and DynamoDB bean pk fields are false positives on correct/structural code — left as-is.

Verification

spotlessCheck, module compilation, and the Micronaut admin controller tests all pass.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
B Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[wolpert]

Superseded by the SonarQube removal — see new PR. We're dropping SonarQube entirely and enforcing line+branch coverage natively via JaCoCo instead of suppressing false positives.