Migrate HTTP server from Spark to Javalin

[eviltester]

Summary

• migrate the HTTP server adapter from SparkJava to Javalin 7.2.2
• add framework-neutral HTTP route abstractions and a confined Javalin adapter
• update Challenger, CRUD UI, standalone apps, test harnesses, docs/static/shutdown routing, and guardrails
• preserve existing HTTP behavior, including legacy HEAD content-length behavior

Closes #53

Verification

• mvn -pl thingifier-crud-ui -am verify
• mvn -pl thingifier,challenger -am verify
• mvn spotless:check
• mvn -pl ercoremodel,thingifier,thingifier-yaml,thingifier-crud-ui,challenger,challengerAuto -am pmd:check checkstyle:check
• mvn -pl challengerAuto -am test "-Dchallenger.auto.target=local" "-Dchallenger.auto.local.repository=memory"
• mvn -pl challengerAuto -am test "-Dchallenger.auto.target=local" "-Dchallenger.auto.local.repository=sqlite-memory"
• focused 413 payload-size challenge checks for single-player and multi-player modes

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e4acfff035

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Guard heartbeat overrides by method and header

For any normal /heartbeat request with a tracked challenger but no X-HTTP-Method-Override header (including the documented GET /heartbeat flow), getHeader(...) returns null and this dereference throws. The Javalin runtime exception handler then returns 400 instead of the route's intended 204 response, and the heartbeat challenge cannot complete. Retain the POST guard and/or compare against a null-safe value.

Useful? React with 👍 / 👎.