[Amir-Golmoradi]

This PR migrates the project’s build and validation workflows from Maven to
Gradle and extends OTP event publishing and audit persistence in the Identity
service.

The build now uses Gradle Kotlin scripts, a root project that includes all seven
modules, and Gradle wrappers for Linux and Windows. Shared dependencies are
declared centrally while preserving each module’s dependency scopes. External
libraries, plugins, generators, and tool versions are defined in the root
version catalog, replacing the duplicated service catalogs. The root Maven
configuration and the Identity and Protobuf Maven build files are removed.

Spotless, Checkstyle, PMD, and SpotBugs are connected to the Gradle check task.
Modules declare their plugins through declarative plugin blocks, while the root
build provides their shared configuration. Checkstyle reuses the existing
project rules, and generated jOOQ and Protobuf code is excluded from analysis.
JUnit Platform discovery and its launcher are configured so Gradle executes the
tests. Identity also receives the PostgreSQL dependency needed to compile its
integration tests and the annotation classes required by SpotBugs.

Protobuf and gRPC generation now use generator dependencies from the version
catalog. Identity’s jOOQ generation moves into Gradle and reads local SQL
snapshots in Flyway filename order without requiring a running database or Vault
credentials. Generation remains an explicit task that refreshes the checked-in
classes. Build caching is disabled for its output because generated and
handwritten sources share a directory.

The quality workflow now runs the hook regression tests and Gradle checks.
Infrastructure verification uses Gradle to run application tests and create
executable service archives, and uploaded test reports use Gradle’s output
paths. Service Dockerfiles build their applications with Gradle, while the
infrastructure image copies executable archives from the Gradle build directory.
Redundant Maven compilation, installation, and plugin-resolution steps are
removed from the image workflow. Spring Boot packaging is enabled for the five
application services, and Identity’s entry point is changed to a public static
main method compatible with executable archive discovery and launching.

The pre-push hook now validates the exact commits being pushed in temporary
detached worktrees. Changes limited to an individual service run that service’s
Gradle checks. Shared code, protocol definitions, repository-wide changes, tags,
and cases without a reliable comparison baseline run the full pull-request
workflows through act. Failed checks block the push, and temporary worktrees are
cleaned up. A reusable installer creates a small loader that delegates to the
tracked hook script, preventing the installed hook from becoming outdated. The
hook also reports a clear error when the pushed commit does not contain the root
Gradle build.

OTP events gain an event identifier and an explicit versioned payload contract.
Kafka publishing serializes that contract with a dedicated mapper, uses the
customer identifier as the partition key, and logs asynchronous delivery
results. Validation messages and diagnostic output consistently use challenge
terminology while retaining redaction of sensitive OTP data. Channel, purpose,
and status source files move into the value-object directory, and internal
purpose implementation names become more descriptive while retaining their
existing serialized values.

A new jOOQ audit adapter writes verification audit events into the Identity
outbox within an existing transaction. A scheduled relay claims eligible events
using database leases and row locking, waits for Kafka acknowledgement, and
marks successful deliveries as published. Failed deliveries receive bounded
exponential retries, and claim tokens prevent an expired worker from updating
another worker’s claim. The SQL snapshot and generated jOOQ records gain claim-
owner and claim-expiry fields. Delivery is at least once, so consumers must
deduplicate events using their event identifiers.

Documentation now describes Gradle builds, executable packaging, code
generation, and hook installation. Infrastructure contract tests check Gradle
module declarations instead of Maven reactor configuration. Generated build
directories and Gradle caches are ignored by Git, and Docker context rules allow
the required packaged service archives.

Local validation passed 319 JUnit tests, five hook regression tests, executable
packaging for all five services, workflow syntax checks, and Dockerfile checks.
Full infrastructure deployment and complete container image builds were not run.
Existing Checkstyle, PMD, and SpotBugs findings still prevent the full quality
check from passing.