fix: 响应信封不再泄露派生字段 success，严格等于 {code, message, data}

- ApiResponse.isSuccess() 加 @JsonIgnore（common 引入 jackson-annotations，仅注解不含 databind）；三波以来所有响应都多带了一个契约外的 success 字段，前端解析器忽略未知字段，无破坏
- 测试补断言 $.success doesNotExist；门禁：./mvnw clean test → BUILD SUCCESS，74 测试 0 失败

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

patbond-auth/src/test/java/com/patbond/patbond/auth/controller/AuthControllerTest.java

@@ -110,7 +110,10 @@ class AuthControllerTest {
                 // Frozen contract: exactly these six fields, nothing else.
                 .andExpect(jsonPath("$.data.username").doesNotExist())
                 .andExpect(jsonPath("$.data.nickname").doesNotExist())
-                .andExpect(jsonPath("$.data.expiresAt").doesNotExist());
+                .andExpect(jsonPath("$.data.expiresAt").doesNotExist())
+                // Envelope is exactly {code, message, data}: the derived
+                // isSuccess() getter must not leak onto the wire.
+                .andExpect(jsonPath("$.success").doesNotExist());
     }
 
     @Test