feat: add environment controller with CRUD endpoints

Implements POST/GET/PATCH/DELETE endpoints at /api/tenants/{tenantId}/environments
with DTOs, mapping helpers, and a Spring Boot integration test (TestContainers).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/main/java/net/siegeln/cameleer/saas/environment/EnvironmentController.java

@@ -0,0 +1,117 @@
+package net.siegeln.cameleer.saas.environment;
+
+import jakarta.validation.Valid;
+import net.siegeln.cameleer.saas.environment.dto.CreateEnvironmentRequest;
+import net.siegeln.cameleer.saas.environment.dto.EnvironmentResponse;
+import net.siegeln.cameleer.saas.environment.dto.UpdateEnvironmentRequest;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.Authentication;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PatchMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.List;
+import java.util.UUID;
+
+@RestController
+@RequestMapping("/api/tenants/{tenantId}/environments")
+public class EnvironmentController {
+
+    private final EnvironmentService environmentService;
+
+    public EnvironmentController(EnvironmentService environmentService) {
+        this.environmentService = environmentService;
+    }
+
+    @PostMapping
+    public ResponseEntity<EnvironmentResponse> create(
+            @PathVariable UUID tenantId,
+            @Valid @RequestBody CreateEnvironmentRequest request,
+            Authentication authentication) {
+        try {
+            UUID actorId = resolveActorId(authentication);
+            var entity = environmentService.create(tenantId, request.slug(), request.displayName(), actorId);
+            return ResponseEntity.status(HttpStatus.CREATED).body(toResponse(entity));
+        } catch (IllegalArgumentException e) {
+            return ResponseEntity.status(HttpStatus.CONFLICT).build();
+        } catch (IllegalStateException e) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        }
+    }
+
+    @GetMapping
+    public ResponseEntity<List<EnvironmentResponse>> list(@PathVariable UUID tenantId) {
+        var environments = environmentService.listByTenantId(tenantId)
+                .stream()
+                .map(this::toResponse)
+                .toList();
+        return ResponseEntity.ok(environments);
+    }
+
+    @GetMapping("/{environmentId}")
+    public ResponseEntity<EnvironmentResponse> getById(
+            @PathVariable UUID tenantId,
+            @PathVariable UUID environmentId) {
+        return environmentService.getById(environmentId)
+                .map(entity -> ResponseEntity.ok(toResponse(entity)))
+                .orElse(ResponseEntity.notFound().build());
+    }
+
+    @PatchMapping("/{environmentId}")
+    public ResponseEntity<EnvironmentResponse> update(
+            @PathVariable UUID tenantId,
+            @PathVariable UUID environmentId,
+            @Valid @RequestBody UpdateEnvironmentRequest request,
+            Authentication authentication) {
+        try {
+            UUID actorId = resolveActorId(authentication);
+            var entity = environmentService.updateDisplayName(environmentId, request.displayName(), actorId);
+            return ResponseEntity.ok(toResponse(entity));
+        } catch (IllegalArgumentException e) {
+            return ResponseEntity.notFound().build();
+        }
+    }
+
+    @DeleteMapping("/{environmentId}")
+    public ResponseEntity<Void> delete(
+            @PathVariable UUID tenantId,
+            @PathVariable UUID environmentId,
+            Authentication authentication) {
+        try {
+            UUID actorId = resolveActorId(authentication);
+            environmentService.delete(environmentId, actorId);
+            return ResponseEntity.noContent().build();
+        } catch (IllegalArgumentException e) {
+            return ResponseEntity.notFound().build();
+        } catch (IllegalStateException e) {
+            return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
+        }
+    }
+
+    private UUID resolveActorId(Authentication authentication) {
+        String sub = authentication.getName();
+        try {
+            return UUID.fromString(sub);
+        } catch (IllegalArgumentException e) {
+            return UUID.nameUUIDFromBytes(sub.getBytes());
+        }
+    }
+
+    private EnvironmentResponse toResponse(EnvironmentEntity entity) {
+        return new EnvironmentResponse(
+                entity.getId(),
+                entity.getTenantId(),
+                entity.getSlug(),
+                entity.getDisplayName(),
+                entity.getStatus().name(),
+                entity.getCreatedAt(),
+                entity.getUpdatedAt()
+        );
+    }
+}

src/main/java/net/siegeln/cameleer/saas/environment/dto/CreateEnvironmentRequest.java

@@ -0,0 +1,13 @@
+package net.siegeln.cameleer.saas.environment.dto;
+
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Pattern;
+import jakarta.validation.constraints.Size;
+
+public record CreateEnvironmentRequest(
+        @NotBlank @Size(min = 2, max = 100)
+        @Pattern(regexp = "^[a-z0-9][a-z0-9-]*[a-z0-9]$", message = "Slug must be lowercase alphanumeric with hyphens")
+        String slug,
+        @NotBlank @Size(max = 255)
+        String displayName
+) {}

src/main/java/net/siegeln/cameleer/saas/environment/dto/EnvironmentResponse.java

@@ -0,0 +1,14 @@
+package net.siegeln.cameleer.saas.environment.dto;
+
+import java.time.Instant;
+import java.util.UUID;
+
+public record EnvironmentResponse(
+        UUID id,
+        UUID tenantId,
+        String slug,
+        String displayName,
+        String status,
+        Instant createdAt,
+        Instant updatedAt
+) {}

src/main/java/net/siegeln/cameleer/saas/environment/dto/UpdateEnvironmentRequest.java

@@ -0,0 +1,9 @@
+package net.siegeln.cameleer.saas.environment.dto;
+
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Size;
+
+public record UpdateEnvironmentRequest(
+        @NotBlank @Size(max = 255)
+        String displayName
+) {}