Implement apix-registry with IoT sunset/decommission lifecycle and full BDD suite

- REST API: register, patch, O-level, replacements, history, search endpoints
- IoT lifecycle validations: future sunset, lock-before-release, sunset-passed-before-decommission
- DB schema: Liquibase changesets 001–008 (services, versions, replacements, sunset-at column)
- @ColumnTransformer(write="?::jsonb") on bsm_payload fields to avoid JDBC varchar→jsonb rejection
- Jandex plugin on apix-common + quarkus.index-dependency so @NotBlank validators resolve at runtime
- quarkus-logging-json extension added; quarkus.log.console.json=false is now a recognised key
- Fix requireSunsetBeforeLockRelease: Boolean.TRUE.equals instead of !Boolean.FALSE.equals (null guard)
- BDD suite: 27 scenarios / 213 steps across 5 feature files (sunset-lock, decommission, replacement, discovery, anonymity)
- Test infrastructure: JDBC TRUNCATE in @Before for DB isolation, Arc.container() for clock control — no test endpoints in production code
- sunsetAt truncated to microseconds in BDD steps to match Postgres timestamptz precision
- Cucumber step fixes: singular/plural candidate(s), lastResponse propagation in replacementsReturnsNCandidates

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,37 @@
+# APIX local development environment
+# Copy to .env and adjust values before running setup-dev.sh.
+# NEVER commit .env to version control.
+
+# ── Database ──────────────────────────────────────────────────────────────────
+APIX_DB_USER=apix
+APIX_DB_PASSWORD=apix
+APIX_DB_NAME=apix
+APIX_DB_PORT=5432
+
+# Quarkus datasource (consumed by apix-registry and apix-spider)
+QUARKUS_DATASOURCE_JDBC_URL=jdbc:postgresql://localhost:5432/apix
+QUARKUS_DATASOURCE_USERNAME=apix
+QUARKUS_DATASOURCE_PASSWORD=apix
+
+# ── API security ──────────────────────────────────────────────────────────────
+# Protects write endpoints (POST /api/register, etc.)
+# Change to a random string in any non-local environment.
+APIX_API_KEY=dev-insecure-key-change-in-prod
+
+# ── External APIs (optional in local dev — leave blank to disable) ─────────────
+GLEIF_API_URL=https://api.gleif.org/api/v1
+OPENCORPORATES_API_KEY=
+
+# Path where the spider caches downloaded sanctions lists
+SANCTIONS_CACHE_PATH=./sanctions-cache
+
+# ── Spider ────────────────────────────────────────────────────────────────────
+# Check interval in minutes (2 = dev, 15 = prod)
+SPIDER_INTERVAL_MINUTES=2
+
+# ── Portal → Registry ─────────────────────────────────────────────────────────
+REGISTRY_BASE_URL=http://localhost:8180
+
+# ── Logging ───────────────────────────────────────────────────────────────────
+# DEBUG in dev; INFO in prod
+LOG_LEVEL=DEBUG