fix: 响应信封不再泄露派生字段 success，严格等于 {code, message, data}

- ApiResponse.isSuccess() 加 @JsonIgnore（common 引入 jackson-annotations，仅注解不含 databind）；三波以来所有响应都多带了一个契约外的 success 字段，前端解析器忽略未知字段，无破坏
- 测试补断言 $.success doesNotExist；门禁：./mvnw clean test → BUILD SUCCESS，74 测试 0 失败

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

patbond-auth/src/test/java/com/patbond/patbond/auth/controller/AuthControllerTest.java

@@ -110,7 +110,10 @@ class AuthControllerTest {
                 // Frozen contract: exactly these six fields, nothing else.
                 .andExpect(jsonPath("$.data.username").doesNotExist())
                 .andExpect(jsonPath("$.data.nickname").doesNotExist())
-                .andExpect(jsonPath("$.data.expiresAt").doesNotExist());
+                .andExpect(jsonPath("$.data.expiresAt").doesNotExist())
+                // Envelope is exactly {code, message, data}: the derived
+                // isSuccess() getter must not leak onto the wire.
+                .andExpect(jsonPath("$.success").doesNotExist());
     }
 
     @Test

patbond-common/pom.xml

@@ -25,6 +25,12 @@
             <groupId>jakarta.validation</groupId>
             <artifactId>jakarta.validation-api</artifactId>
         </dependency>
+        <!-- Annotations only (no databind): keeps the wire shape of the shared
+             envelope under the contract module's control. -->
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-annotations</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-test</artifactId>

patbond-common/src/main/java/com/patbond/patbond/common/response/ApiResponse.java

@@ -1,5 +1,7 @@
 package com.patbond.patbond.common.response;
 
+import com.fasterxml.jackson.annotation.JsonIgnore;
+
 public class ApiResponse<T> {
 
     private Integer code;
@@ -23,6 +25,11 @@ public class ApiResponse<T> {
         return new ApiResponse<>(code, message, null);
     }
 
+    /**
+     * Derived convenience only — not part of the frozen wire contract
+     * {@code {code, message, data}}, hence never serialized.
+     */
+    @JsonIgnore
     public boolean isSuccess() {
         return Integer.valueOf(0).equals(code);
     }