Full Changelog

Seed credentialMinLength and credentialMaxLength (DEV-1194) into the ACS
configuration security group (INTEGER, defaults 7/180) so they are managed
centrally and published to ACS via the Hazelcast snapshot. ACS reads them
from the snapshot using its existing DMConfigurationParameter enum, so no
ACS-side change is required.

Add cross-field validation in AcsConfigurationValidator: credentialMinLength
must be strictly less than credentialMaxLength. The counterpart value is read
from candidateValues, which already carries the full persisted state, so the
rule holds whether one or both fields are edited.

Keep server logs locale-independent while still returning localized messages
to the client. ft-exceptions FriendlyException exposes a single description
field used for both the log (and stack-trace header) and the client response,
and has private constructors so it cannot be subclassed. Introduce
LocalizedValidationException carrying an English message for the log plus a
localized ErrorDetails for the response, with a dedicated exception handler.
Validator and DryRunMessageService now accept an explicit locale (null for the
current user, ENGLISH for logs).

The builder stage ran ./gradlew bootJar without GitHub Packages
credentials, so com.friendly:* dependencies failed to resolve with
"Username must not be null!". Mount github_user/github_token as
BuildKit secrets and export them as GITHUB_USERNAME/GITHUB_TOKEN for
the Gradle invocation (not persisted in image layers).

Also exclude test tasks explicitly to keep integration tests off the
image build step.

Point CACHE_CONFIG_PATH at classpath: so the bundled hazelcast-client.yaml
is used by default instead of the mounted file:/etc/app/ path. Sync the
installation docs examples and troubleshooting note accordingly.

Add a troubleshooting section for the 502 Bad Gateway returned by the UI
nginx proxy: static assets load but /configs-service/** fails with a DNS
SERVFAIL because the UI proxies to a public FQDN that resolves IPv6-only
inside the IPv4 Docker network. Document the preferred fix (point the UI
at the internal service name via BACKEND_URL=http://ft-configs-service:8080)
and the DNS/extra_hosts alternatives.

Update CORS guidance: the UI is served on both HTTP (3001) and HTTPS (3443),
so CORS_ALLOWED_ORIGINS must list both scheme variants. Switch the .env
examples to host placeholders and warn that the origin is the browser-facing
host, never the internal Docker service name (which belongs in BACKEND_URL).

The container runs as non-root (UID 1001) and writes file logs to the
bind-mounted logs/ directory, which is created as root on the host. Add
a chown step and a note so file logging works instead of silently
falling back to stdout only.

Add a Developer Guide page (anatomy of a config domain, adding a new
domain end-to-end, consuming configs via Hazelcast cache and REST).

Document every env var the service actually reads but that was missing
from the templates: MAIL_LOGIN_URL, AUDIT_RETENTION_DAYS,
AUDIT_REDACTION_FIELDS, ORACLE_SCHEMA, FT_CONFIGS_ACS_EXCLUSION_MODELS_CACHE_NAME.
Fix JWT_SECRET guidance (Base64, openssl rand -base64 32), use example
values for mail settings, and keep the .env files and installation.adoc
snippets identical (comments on separate lines for docker --env-file safety).

Liquibase only creates tables inside an existing schema; the database
and user must be provisioned beforehand. Add a dedicated step with
MySQL and Oracle scripts, and align the Oracle env user with the
provisioning script (ftacs -> configs).

cache-to=gha export failures (e.g. transient GHA cache 5xx/400 outages)
were aborting the whole build job even after the image was built and
pushed. Add ignore-error=true so a cache export hiccup is logged but
non-fatal, matching the northbound-api pipeline.