Add CodeQL (SAST), SpotBugs+FindSecBugs (SAST via verify), OWASP Dependency Check
and OWASP ZAP baseline scan (DAST) to the CI/CD pipeline.
Docker deploy is gated behind ci, sast-codeql and dast jobs.
Fix DM_DEFAULT_ENCODING spotted by SpotBugs: use StandardCharsets.UTF_8 in Basic Auth encoding.
Add multi-stage Dockerfile with eclipse-temurin:17 and HEALTHCHECK on /actuator/health.
Expose /actuator/health endpoint via spring-boot-starter-actuator.
Deduplicate alerts: only notify when a room's CO2 level changes, reset on recovery.
Assisted-by: Claude:claude-sonnet-4-6
Replace Microsoft Teams webhook integration with Telegram Bot API.
Remove Teams-specific models (MessageCard, Section, Fact) and service.
Add TelegramNotificationService using TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID
environment variables.
Assisted-by: Claude:claude-sonnet-4-6