[DT-4061] Add study ratings and comments

[otchet-broad]

Base: branch 2 · 17 files, +944 · Migration: yes (1 changeset) · UI impact: none

Adds a study_comment table and the endpoints behind it: GET/POST /api/dataset/study/{studyId}/comments and DELETE /api/dataset/study/{studyId}/comments/{commentId}. The list response carries
the comments plus their average rating.

One comment per user per study, enforced by a unique constraint on
(study_id, user_id), so POST upserts rather than accumulating rows. Rating
is constrained to 1–5 in the database as well as the service. Posting
requires an active researcher — the Researcher role plus a library card.
Deletes only ever remove the caller's own comment: the user id is part of the
DELETE predicate rather than a check performed before it.

Reads go through verifyStudyVisibilityAccess, so comments on a study that
is not publicly visible are readable only by its creator, its custodians, and
admins — the same rule the study itself uses.

Entirely additive: new table, new endpoints, no change to any existing
response, and nothing in the running UI calls these yet.

Depends on: branch 1 (visibility gate).

---

Where this sits in the DT-4061 stack

otchet-dt-3990-study-ratings-pi-details was too large to review meaningfully
(95 files, +8168), so it was split into eight PRs. This PR targets otchet-dt-4061-study-pi-details,
not develop, so its diff shows only its own work.

#	Branch	Base
1	otchet-dt-4061-study-visibility-authz	develop
1b	otchet-dt-4061-study-patch-ownership	otchet-dt-4061-study-visibility-authz
2	otchet-dt-4061-study-pi-details	otchet-dt-4061-study-visibility-authz
3	otchet-dt-4061-study-comments ← this PR	otchet-dt-4061-study-pi-details
4	otchet-dt-4061-study-dar-metrics	otchet-dt-4061-study-comments
5	otchet-dt-4061-study-recommendations	otchet-dt-4061-study-dar-metrics
6	otchet-dt-4061-study-asset-fields	otchet-dt-4061-study-recommendations
7	otchet-dt-4061-study-asset-endpoints	otchet-dt-4061-study-asset-fields

Branch 1b is a sibling rather than a link in the chain: nothing depends on it,
so it can be held or dropped without blocking the others. Land the numbered
chain in order — merging out of order, or squash-merging, will require rebasing
the descendants.

The split is verified lossless: branch 7 plus 1b reproduces the original branch
exactly, apart from five scripts/verify-study-*.sh helper scripts that were
dropped at the author's request. ./mvnw test-compile passes on each branch
independently.

🤖 Generated with Claude Code