chore: record pre-existing uncommitted repository state

Snapshot of the in-flight state that already existed, identically, in both
this worktree and the main checkout before this session began: the initial
HTTP Client platform implementation (previously untracked), the redis-lab
removal, and the JPA / object-storage / notification integration work.

Kept separate from this session's HTTP Client review response, which lands
in the following commit, so the two bodies of work stay reviewable apart.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/Dockerfile

@@ -27,7 +27,7 @@ FROM eclipse-temurin:21-jdk-jammy@sha256:801b7e1a9c4befaf82bf9a2a58025ef43a7694b
 ARG RELEASE_VERSION
 ARG GIT_SHA
 
-WORKDIR /build
+WORKDIR /build/src
 
 # Copy the Gradle wrapper and every module's build descriptor + dependency lockfile FIRST,
 # so the expensive dependency-resolution layer is cached and only re-runs when a build.gradle
@@ -38,6 +38,7 @@ WORKDIR /build
 # (Requires the labs Dockerfile frontend — see the `# syntax` directive at the top of this file.)
 COPY gradlew ./
 COPY gradle/ gradle/
+COPY config/ ./config/
 COPY --parents settings.gradle build.gradle **/build.gradle **/gradle.lockfile ./
 
 # Resolve every module configuration in STRICT mode (no --write-locks in a release build). This
@@ -48,14 +49,11 @@ RUN test -n "${RELEASE_VERSION}" \
  && ./gradlew verifyDependencyLocks --no-daemon --quiet \
       -PreleaseVersion="${RELEASE_VERSION}" -PgitRevision="${GIT_SHA}"
 
-# Copy full source and build the JAR
+# Copy full source and stage the executable JAR at Gradle's declared Docker output path.
 COPY . .
-RUN ./gradlew :app-bootstrap:bootJar --no-daemon -x test \
+RUN ./gradlew :app-bootstrap:stageDockerJar --no-daemon -x test \
       -PreleaseVersion="${RELEASE_VERSION}" -PgitRevision="${GIT_SHA}"
 
-# Locate the produced JAR (avoids hardcoding the version string)
-RUN cp $(ls app-bootstrap/build/libs/*.jar | grep -v plain | head -1) /build/app.jar
-
 # ---- Stage 2: runtime image -------------------------------------------------
 # JRE-only slim image (D3: no full JDK in production image).
 # Uses eclipse-temurin:21-jre-jammy — the Adoptium-supported JRE variant.
@@ -114,9 +112,20 @@ RUN mkdir -p /var/tmp/heap && chmod 1777 /var/tmp/heap
 RUN groupadd --system --gid 1000 app \
  && useradd --system --uid 1000 --gid app --no-create-home --shell /usr/sbin/nologin app
 
+# ---- Fileserver storage root ------------------------------------------------
+# Created in the image with the runtime user's ownership and 0750, so a fresh named volume
+# mounted here inherits both. Without it the Fileserver platform's default root does not exist
+# on a read-only root filesystem, and the capability fails on its first upload rather than at
+# startup. This directory is a mount point, not a place to keep data in the image: an unmounted
+# container writes into the container layer and loses everything on replacement.
+RUN mkdir -p /var/lib/backend/files \
+ && chown app:app /var/lib/backend/files \
+ && chmod 0750 /var/lib/backend/files
+VOLUME ["/var/lib/backend/files"]
+
 WORKDIR /app
 
-COPY --from=builder --chown=app:app /build/app.jar app.jar
+COPY --from=builder --chown=app:app /build/src/app-bootstrap/build/docker/application.jar app.jar
 
 USER app