Bind IDOR level 2 profile lookup to token owner

[r1kka6]

Summary

• derive the Level 2 profile id from the validated token instead of the client-controlled userId_level2 cookie
• keep the existing login flow while making cookie tampering ineffective
• update unit coverage to assert that a tampered cookie still resolves to the token owner

Verification

• ./gradlew test spotlessJavaCheck bootJar --no-daemon passed in an eclipse-temurin:17-jdk container
• vulnerable baseline lets Alice read Bob by changing userId_level2=1 to userId_level2=2
• patched runtime returns Alice for both the original cookie and the tampered userId_level2=2 cookie