feat(decision): add read-only replay diffing a candidate against recorded decisions

[tiana-code]

What

Closes #173. Replay (champion/challenger): evaluate a candidate ruleset against caller-supplied historical inputs and diff each outcome against the decision that was actually recorded, so a rule author can see the blast radius of a change before publishing. Read-only and deterministic.

Endpoint

POST /v1/decision/replay (decision:write):

{ "candidate": <DSL object>, "inputs": [ <attr map>, ... ] }

For each input it computes the canonical input hash, finds the most recent recorded decision_logs row for that hash, evaluates the candidate, and diffs. Response:

{ total, unchanged, changed, noBaseline, diffs: [ { inputHash, recorded?, candidate, status } ] }

status is UNCHANGED (recorded equals candidate), CHANGED, or NO_BASELINE (no recorded decision for that input).

Guarantees

• Read-only: no decision_logs row is written, the candidate is never stored, @Transactional(readOnly = true), no log-writer dependency. The IT asserts the audit row count is unchanged after a replay.
• Fail-closed + ReDoS-safe: the candidate is validated through the engine parser (invalid -> 422) and size-capped before parsing, then evaluated under the same bounded-time BoundedEvaluator guard as evaluation; a catastrophic candidate pattern fails the whole replay with a typed 503 rather than hanging.
• Bounded input: per-attribute caps (shared with evaluate) and a replay input-count cap; null body elements and a null candidate are rejected as 400 (@JsonSetter(... = FAIL)), not 500.

Refactor

Extracted a shared InputMapper (the input-JSON-to-typed-attributes mapping + caps) used by both evaluate (#172b) and replay, so the caps live in one place. The merged evaluate tests were updated to the new constructor and the mapping/cap tests migrated into InputMapperTest.

Tests

InputMapperTest, ReplayServiceImplTest (changed/unchanged/no-baseline incl. both-not-matched, aggregate sums, never-writes, invalid/too-large/cap), ReplayControllerTest (@WebMvcTest: scopes, 422, null-body -> 400), and DecisionReplayApiIT (@SpringBootTest: a CHANGED diff with the audit count unchanged, no-baseline, a ReDoS candidate -> 503, scope authz).

Note

A pre-existing observation (carried to the #176 perf gate, not changed here): EvaluationServiceImpl holds its JDBC connection during the bounded evaluation inside @Transactional; it is timeout-bounded and the read-only replay path is unaffected.

Closes #173