Implement apix-registry with IoT sunset/decommission lifecycle and full BDD suite

- REST API: register, patch, O-level, replacements, history, search endpoints
- IoT lifecycle validations: future sunset, lock-before-release, sunset-passed-before-decommission
- DB schema: Liquibase changesets 001–008 (services, versions, replacements, sunset-at column)
- @ColumnTransformer(write="?::jsonb") on bsm_payload fields to avoid JDBC varchar→jsonb rejection
- Jandex plugin on apix-common + quarkus.index-dependency so @NotBlank validators resolve at runtime
- quarkus-logging-json extension added; quarkus.log.console.json=false is now a recognised key
- Fix requireSunsetBeforeLockRelease: Boolean.TRUE.equals instead of !Boolean.FALSE.equals (null guard)
- BDD suite: 27 scenarios / 213 steps across 5 feature files (sunset-lock, decommission, replacement, discovery, anonymity)
- Test infrastructure: JDBC TRUNCATE in @Before for DB isolation, Arc.container() for clock control — no test endpoints in production code
- sunsetAt truncated to microseconds in BDD steps to match Postgres timestamptz precision
- Cucumber step fixes: singular/plural candidate(s), lastResponse propagation in replacementsReturnsNCandidates

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/reset.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# Full dev environment reset: stop everything, drop and recreate the DB,
+# re-run all Liquibase migrations, then restart dev servers.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+
+GREEN='\033[0;32m'; YELLOW='\033[1;33m'; RED='\033[0;31m'; NC='\033[0m'
+info() { echo -e "${GREEN}[apix]${NC} $*"; }
+warn() { echo -e "${YELLOW}[warn]${NC} $*"; }
+die()  { echo -e "${RED}[fail]${NC} $*" >&2; exit 1; }
+
+warn "This will DROP and recreate the local 'apix' database."
+read -rp "Continue? [y/N] " confirm
+[[ "${confirm,,}" == "y" ]] || { echo "Aborted."; exit 0; }
+
+# Stop everything
+info "Stopping dev servers"
+"$SCRIPT_DIR/stop.sh"
+
+# Load .env
+cd "$PROJECT_ROOT"
+if [[ ! -f .env ]]; then
+  die ".env not found — run ./scripts/setup-dev.sh first."
+fi
+set -a
+# shellcheck disable=SC1091
+source .env
+set +a
+
+DB_USER="${APIX_DB_USER:-apix}"
+DB_PASS="${APIX_DB_PASSWORD:-apix}"
+DB_NAME="${APIX_DB_NAME:-apix}"
+DB_PORT="${APIX_DB_PORT:-5432}"
+
+# Remove and recreate the container (fastest way to wipe the DB on local dev)
+info "Removing apix-postgres container"
+docker rm -f apix-postgres 2>/dev/null || true
+
+info "Starting fresh PostgreSQL container"
+docker run -d \
+  --name apix-postgres \
+  --restart unless-stopped \
+  -e POSTGRES_USER="$DB_USER" \
+  -e POSTGRES_PASSWORD="$DB_PASS" \
+  -e POSTGRES_DB="$DB_NAME" \
+  -p "${DB_PORT}:5432" \
+  postgres:16-alpine >/dev/null
+
+info "Waiting for PostgreSQL…"
+for i in $(seq 1 30); do
+  if docker exec apix-postgres pg_isready -U "$DB_USER" -q 2>/dev/null; then
+    info "PostgreSQL ready"
+    break
+  fi
+  [[ $i -eq 30 ]] && die "PostgreSQL did not become ready. Check: docker logs apix-postgres"
+  sleep 1
+done
+
+info "Running Liquibase migrations"
+mvn -q liquibase:update -pl apix-registry \
+  -Dliquibase.url="jdbc:postgresql://localhost:${DB_PORT}/${DB_NAME}" \
+  -Dliquibase.username="$DB_USER" \
+  -Dliquibase.password="$DB_PASS"
+info "Migrations applied"
+
+info "Reset complete — starting dev servers"
+"$SCRIPT_DIR/dev.sh"