refactor(config): migrate @ConfigurationProperties from @component to @EnableConfigurationProperties

Remove @component and @propertysource from DevLoginConfigProperties and
WebAuthnConfigProperties so they are passive data holders per Spring Boot
convention. Registration is now handled by dedicated @configuration
classes with @EnableConfigurationProperties:

- DevLoginAutoConfiguration: guards with @Profile("local") and
  @ConditionalOnProperty, owns @propertysource
- WebAuthnAutoConfiguration: always active (WebSecurityConfig requires
  the properties), owns @propertysource

Closes #263

Author: devondragon

src/main/java/com/digitalsanctuary/spring/user/dev/DevLoginAutoConfiguration.java

@@ -0,0 +1,24 @@
+package com.digitalsanctuary.spring.user.dev;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Profile;
+import org.springframework.context.annotation.PropertySource;
+
+/**
+ * Auto-configuration for the dev login feature.
+ * <p>
+ * Activates only when the {@code local} profile is active and
+ * {@code user.dev.auto-login-enabled=true}. Individual dev-login components
+ * ({@link DevLoginController}, {@link DevLoginStartupWarning}) carry their own
+ * guards for defense-in-depth.
+ * </p>
+ */
+@Configuration
+@Profile("local")
+@ConditionalOnProperty(name = "user.dev.auto-login-enabled", havingValue = "true", matchIfMissing = false)
+@PropertySource("classpath:config/dsspringuserconfig.properties")
+@EnableConfigurationProperties(DevLoginConfigProperties.class)
+public class DevLoginAutoConfiguration {
+}

src/main/java/com/digitalsanctuary/spring/user/dev/DevLoginConfigProperties.java

@@ -1,8 +1,6 @@
 package com.digitalsanctuary.spring.user.dev;
 
 import org.springframework.boot.context.properties.ConfigurationProperties;
-import org.springframework.context.annotation.PropertySource;
-import org.springframework.stereotype.Component;
 import lombok.Data;
 
 /**
@@ -17,8 +15,6 @@
  * </p>
  */
 @Data
-@Component
-@PropertySource("classpath:config/dsspringuserconfig.properties")
 @ConfigurationProperties(prefix = "user.dev")
 public class DevLoginConfigProperties {
 

src/main/java/com/digitalsanctuary/spring/user/security/WebAuthnAutoConfiguration.java

@@ -0,0 +1,20 @@
+package com.digitalsanctuary.spring.user.security;
+
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.PropertySource;
+
+/**
+ * Auto-configuration that registers {@link WebAuthnConfigProperties}.
+ * <p>
+ * This configuration is always active because {@code WebSecurityConfig} requires
+ * {@link WebAuthnConfigProperties} regardless of whether WebAuthn is enabled.
+ * Individual WebAuthn components carry their own
+ * {@code @ConditionalOnProperty(name = "user.webauthn.enabled")} guards.
+ * </p>
+ */
+@Configuration
+@PropertySource("classpath:config/dsspringuserconfig.properties")
+@EnableConfigurationProperties(WebAuthnConfigProperties.class)
+public class WebAuthnAutoConfiguration {
+}

src/main/java/com/digitalsanctuary/spring/user/security/WebAuthnConfigProperties.java

@@ -2,16 +2,12 @@
 
 import java.util.Set;
 import org.springframework.boot.context.properties.ConfigurationProperties;
-import org.springframework.context.annotation.PropertySource;
-import org.springframework.stereotype.Component;
 import lombok.Data;
 
 /**
  * Configuration properties for WebAuthn (Passkey) authentication.
  */
 @Data
-@Component
-@PropertySource("classpath:config/dsspringuserconfig.properties")
 @ConfigurationProperties(prefix = "user.webauthn")
 public class WebAuthnConfigProperties {