feat: Implement JWT security hardening (JwtAuthFilter, stateless sessions, endpoint restrictions)

[coderabbitai]

Summary

This issue tracks the full JWT/Spring Security implementation that will replace the temporary permissive SecurityConfig introduced in PR #55.

Background

PR #55 (feat/comment-controller) added a SecurityConfig with anyRequest().permitAll() as a temporary measure to unblock development and testing. This must be hardened before reaching production.

Tasks

• Implement JwtAuthFilter to validate JWT tokens on incoming requests
• Configure stateless session management (SessionCreationPolicy.STATELESS)
• Restrict /api/comments/** to authenticated users only (replacing the global permitAll)
• Restrict other protected routes as appropriate
• Ensure @AuthenticationPrincipal User in CommentController receives a valid non-null principal when endpoints are called with a valid token

References

• PR Feat/comment controller #55 comment: Feat/comment controller #55 (comment)
• Requested by: @annikaholmqvist94

Notes

Until this is implemented, the @AuthenticationPrincipal User parameters in CommentController will silently receive null for unauthenticated requests.