Implement apix-registry with IoT sunset/decommission lifecycle and full BDD suite

- REST API: register, patch, O-level, replacements, history, search endpoints
- IoT lifecycle validations: future sunset, lock-before-release, sunset-passed-before-decommission
- DB schema: Liquibase changesets 001–008 (services, versions, replacements, sunset-at column)
- @ColumnTransformer(write="?::jsonb") on bsm_payload fields to avoid JDBC varchar→jsonb rejection
- Jandex plugin on apix-common + quarkus.index-dependency so @NotBlank validators resolve at runtime
- quarkus-logging-json extension added; quarkus.log.console.json=false is now a recognised key
- Fix requireSunsetBeforeLockRelease: Boolean.TRUE.equals instead of !Boolean.FALSE.equals (null guard)
- BDD suite: 27 scenarios / 213 steps across 5 feature files (sunset-lock, decommission, replacement, discovery, anonymity)
- Test infrastructure: JDBC TRUNCATE in @Before for DB isolation, Arc.container() for clock control — no test endpoints in production code
- sunsetAt truncated to microseconds in BDD steps to match Postgres timestamptz precision
- Cucumber step fixes: singular/plural candidate(s), lastResponse propagation in replacementsReturnsNCandidates

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/arc42/01-introduction-goals.md

@@ -0,0 +1,32 @@
+---
+arc42: "1 — Introduction and Goals"
+status: stub
+---
+
+## 1.1 MVP Goal Statement
+
+TODO: Define what must be provable at the end of the PoC phase.
+Key question: What does a Sovereign Tech Fund reviewer need to see to confirm this is real running infrastructure?
+
+## 1.2 Quality Goals
+
+TODO: Top 3–5 quality goals, measurable.
+Example dimensions: Queryability, Correctness of liveness status, Registration reliability, Availability.
+
+## 1.3 Stakeholders
+
+| Role | Expectation |
+|---|---|
+| STF reviewer | Running public URL, queryable, real services registered |
+| Agent developer | Capability search returns structured, machine-readable results |
+| Service registrant | Registration via portal or API; status visible within minutes |
+| BSF (Carsten) | Deployable solo; maintainable; demonstrable to founding members |
+
+## 1.4 Out of Scope (MVP)
+
+- Billing and commercial tiers
+- Automated O-level / S-level verification
+- Multi-region redundancy
+- Full CE/regulatory BSM validation
+- Agent Enterprise composition layer
+- IoT device template persistence (DC-1)