cfa989bd5e
- Add @Primary + @ConditionalOnMissingBean so TestSecurityConfig.jwtDecoder() wins over SecurityConfig.jwtDecoder() without needing a real OIDC endpoint - Add spring.main.allow-bean-definition-overriding=true and cameleer.clickhouse.enabled=false to src/test/resources/application-test.yml so Testcontainers @ServiceConnection can supply the datasource - Disable ClickHouse in test profile (src/main/resources/application-test.yml) so the explicit ClickHouseConfig DataSource bean is not created, allowing @ServiceConnection to wire the Testcontainers Postgres datasource - Fix TenantControllerTest and LicenseControllerTest to explicitly grant ROLE_platform-admin authority via .authorities() on the test JWT, since spring-security-test does not run the custom JwtAuthenticationConverter - Fix EnvironmentService.createDefaultForTenant() to use an internal bootstrap path that skips license enforcement (chicken-and-egg: no license exists at tenant creation time yet) - Remove now-unnecessary license stub from EnvironmentServiceTest Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>