fix(quality): enumeration guard, value cap, attribute migration, concurrency lock, group-resolution — M3, M6, M7, M8, L5

[rubenvdlinde]

Summary

• M3 ([MEDIUM] M3: searchSharees enumerates users/groups on 1-char query with no rate limit #331): searchSharees minimum query length raised from 1 to 2 characters — limits single-character a..z user/group directory sweeps consistent with NC's own share-autocomplete threshold.
• M6 ([MEDIUM] M6: PreferencesController setPreference has no value size limit — per-user DB bloat DoS #334): PreferencesController::setPreference now rejects values longer than 8192 bytes (HTTP 400) to prevent unbounded oc_preferences row growth from malicious callers.
• M7 ([MEDIUM] M7: PreferencesController uses docblock @NoAdminRequired instead of PHP 8 attribute #335): PreferencesController @NoAdminRequired / @NoCSRFRequired docblock annotations converted to PHP 8 attribute form (#[NoAdminRequired], #[NoCSRFRequired]) for forward-compatibility with NC 30+ strict-attribute mode.
• M8 ([MEDIUM] M8: DemoShowcasesService installShowcase — no concurrency lock, duplicate dashboard rows on simultaneous install #336): DemoShowcasesService::installShowcase acquires an exclusive ILockingProvider advisory lock before the existence check, preventing duplicate dashboard rows from concurrent admin installs of the same showcase.
• L5 ([LOW] L5: DashboardMetadataController uses IGroupManager::isInGroup directly instead of AdminTemplateService::getUserGroupIdsFor #341): DashboardMetadataController::canRead and canWrite now call AdminTemplateService::getUserGroupIdsFor (REQ-TMPL-013 — single source of truth) instead of IGroupManager::isInGroup directly, keeping virtual/nested group resolution consistent with the service layer.

Test plan

• searchSharees?query=a → empty result (was returning matches)
• searchSharees?query=ab → matches as before
• setPreference with value >8192 bytes → HTTP 400
• getPreference / setPreference still work for non-admin users (attributes in effect)
• Concurrent admin calls to POST /admin/showcases/{id}/install → second call gets error, no duplicate dashboards
• DashboardMetadataController group-share membership still checked correctly

🤖 Generated with Claude Code