[codex] Raise backend coverage to 95 percent

[jjoonleo]

Summary

• add JaCoCo coverage reporting and enforce a 95% backend instruction coverage gate
• fix OAuth first-time registration tokens to use the persisted user ID for Google, Apple, and Kakao
• replace weak coverage-oriented tests with behavior-focused service, security, OAuth, alarm, scheduler, DTO, entity, recovery, and API contract tests
• add a mutation-test plan documenting the local break-and-fail validation for critical behaviors

Frontend impact

• OAuth sign-up access tokens now include the persisted userId claim instead of null for new Google, Apple, and Kakao users
• no endpoint, request body, response envelope, or header contract was intentionally changed

Validation

• JAVA_HOME=/Users/ejunpark/.sdkman/candidates/java/current PATH=/Users/ejunpark/.sdkman/candidates/java/current/bin:$PATH ./gradlew clean check
• JaCoCo instruction coverage: 11152/11691 = 95.39%
• git diff --check