Spring Security 7.1 JWT authentication on Spring Boot 4.1

Runnable companion for https://ankurm.com/spring-security-7-1-jwt-authentication-guide/

- login -> token issue -> OncePerRequestFilter -> SecurityContext, end to end
- HS256 and RS256 variants (RS256 publishes a real JWKS endpoint)
- the same API secured by the built-in oauth2ResourceServer().jwt(), for comparison
- 11 documentation chapters under docs/, interlinked with the code
- docs/output/ is real captured output, regenerated by scripts/run-all.sh
- 13 passing tests pinning the 401-vs-403 contract and the CSRF failure

Verified against Spring Boot 4.1.1, Spring Security 7.1.1, JDK 25.0.4.1.

docs/output/csrf-vs-permitall.txt

@@ -0,0 +1,54 @@
+==========================================================================
+ jwt-auth-demo - CSRF vs permitAll()
+ app started with: --spring.profiles.active=hs256,csrfon
+==========================================================================
+
+--------------------------------------------------------------------------
+# A. The login endpoint is permitAll(). POST it anyway.
+#    403 - and nothing in the authorization rules explains why.
+
+HTTP 403
+WWW-Authenticate: Bearer
+
+--------------------------------------------------------------------------
+# B. GET on the same permitAll() path family works. Only unsafe methods break.
+
+HTTP 200
+Content-Type: application/json
+{
+    "authenticationRequired": false,
+    "status": "up"
+}
+
+
+--------------------------------------------------------------------------
+# C. The filter chain, with CsrfFilter present. Count the positions:
+#    CsrfFilter is 5th, AuthorizationFilter is last. The request never
+#    reaches the filter that knows about permitAll().
+
+HTTP 200
+Content-Type: application/json
+[
+    {
+        "matchesThisRequest": true,
+        "filters": [
+            "DisableEncodeUrlFilter",
+            "WebAsyncManagerIntegrationFilter",
+            "SecurityContextHolderFilter",
+            "HeaderWriterFilter",
+            "CsrfFilter",
+            "JwtAuthenticationFilter",
+            "RequestCacheAwareFilter",
+            "SecurityContextHolderAwareRequestFilter",
+            "AnonymousAuthenticationFilter",
+            "SessionManagementFilter",
+            "ExceptionTranslationFilter",
+            "AuthorizationFilter"
+        ],
+        "chain": "DefaultSecurityFilterChain defined as 'apiFilterChain' in [class path resource [com/ankurm/jwtauth/config/SecurityConfig.class]] matching [any request] and having filters [DisableEncodeUrl, WebAsyncManagerIntegration, SecurityContextHolder, HeaderWriter, Csrf, JwtAuthentication, RequestCacheAware, SecurityContextHolderAwareRequest, AnonymousAuthentication, SessionManagement, ExceptionTranslation, Authorization]"
+    }
+]
+
+
+--------------------------------------------------------------------------
+# end