[littlegrasscao]

Summary

• ActivationService redeems activation links: GET {activation.base-path}/{code}, with no provider token, turns a one-time activation code into a Delta Sharing profile file (shareCredentialsVersion, bearerToken, endpoint, expirationTime)
  • the bearer token is generated at redemption and stored only as a SHA-256 hash (TokenHashes); the token row is locked, so a concurrent redemption of the same code fails
  • an unknown, used, or expired code is 404 RESOURCE_DOES_NOT_EXIST; once the code is redeemed, the recipient's activationUrl is omitted
  • the profile's endpoint is server.public-url plus the new protocol.base-path (default /api/1.0/opensharing), not the address the activation request arrived on
• tokenExpirationDays is required on create and must be positive; the token expires that many days after it is issued
• POST /recipients/{recipient}/rotate-token issues a replacement token with a new activation URL. Existing tokens stop working immediately unless existingTokenExpireInSeconds sets a grace window. Owner only
  • the recipient's row lock from server: add provider-admin recipient entities and CRUD #98 makes concurrent rotations run one at a time, so each supersedes the one before it and only the newest activation URL can be redeemed

Testing

• mvn clean install: 112 tests passed
• ActivationServiceTest: an unknown code is 404; redeeming a link returns the profile and stores only the token hash, and redeeming it again is 404
• RecipientAdminServiceTest: create requires tokenExpirationDays and puts the expiration on the profile; rotation is owner-only, invalidates the old pending activation, requires a lifetime, and without a grace window expires the activated token immediately
• ProfileEndpointTest: with server.public-url set to another address, the redeemed profile points at it
• RecipientRotationConcurrencyTest: after 8 concurrent rotations of one recipient, exactly one returned activation URL can be redeemed
• earlier tests that create recipients now send tokenExpirationDays

Stacked on #99.