Full UI rewrite onto @ossrandom/design-system v0.3.0 (npm). Replaces
Ant Design + ECharts + @ant-design/icons with the design-system
primitives + charts subpath + an inline-SVG icon set.

Surface changes:
- AppShell-based header with a single IconButton theme toggle and a
  monospace MCP-URL pill (copy-to-clipboard).
- Stats grid replaced with a CSS auto-fit grid (mobile-responsive).
- File-tree treemap renders via @ossrandom/design-system/charts
  (d3-hierarchy, canvas engine, maxDepth=1) with an explicit drill-down
  / drill-up affordance via a breadcrumb row; treemap layout is
  deterministic (children sorted alphabetically, fixed height, single
  remount via key when focusPath changes).
- File viewer drawer kept; MCP Tools sidebar removed (the design-system
  Menu's nested-inline expansion didn't match the prior UX).
- Three orphan pages deleted (Explorer.tsx, McpConsole.tsx,
  CodebaseMap.tsx) — none were routed in App.tsx.
- index.css trimmed to body reset + layout-only classes using
  design-system CSS tokens; `.rcs-treemap-engine-badge` hidden via a
  single rule.
- vite.config.ts: manualChunks reorganised
  (vendor-ds / vendor-ds-charts replace vendor-antd / vendor-echarts).

Bundled fonts and the deck.gl tesselator chunk live alongside the
hashed JS in src/main/resources/static/assets/ — air-gapped requirement
per build.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

When `mcp.auth.mode=none` AND `allow_unauthenticated=true`, the filter
used to call chain.doFilter(...) without setting an Authentication on
the SecurityContext. The SecurityFilterChain has

    .requestMatchers("/api/**", "/mcp/**", "/actuator/**").authenticated()
    .anonymous().disable()

so requests reaching the controllers without a Principal were rejected
with 403 — the "unauthenticated" escape hatch was inert. Bypass branch
now installs a fake PreAuthenticatedAuthenticationToken with role
ROLE_MCP_CLIENT (mirroring the bearer-success path) and clears the
context in finally, so the chain's authenticated() rule passes.

Behavioural impact only when allow_unauthenticated=true; bearer mode
unaffected.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Built-in defaults now produce a server that starts unauthenticated out
of the box. The fail-fast safety valve still works: explicitly setting
mcp.auth.allow_unauthenticated=false in codeiq.yml (or env) makes
mode=none refuse to start under the serving profile.

ConfigDefaults previously emitted

    new McpAuthConfig("none", "CODEIQ_MCP_TOKEN", null, null)

which evaluated to allowUnauthenticated=false at runtime; combined with
TokenResolver's serving-profile gate, this hard-failed every fresh
install on `codeiq serve`. Operators wanting auth in production opt in
explicitly via mode=bearer (and CODEIQ_MCP_TOKEN env var).

McpAuthConfig javadoc updated to document the new default semantics:
allow_unauthenticated is now an opt-in *harden* flag (set false to
reject mode=none) rather than an opt-in *escape hatch*.

BREAKING (defaults): a fresh install no longer prompts for or enforces
a token. Upgraded deployments that already set mode=bearer in
codeiq.yml are unaffected. To preserve the prior fail-fast behaviour,
set mcp.auth.allow_unauthenticated: false explicitly.

Tests: TokenResolverTest, ConfigDefaultsTest, ServingChainIntegrationTest,
UnifiedConfigAdapterTest — 27/27 pass. Full suite: 3706 / 0 / 32.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Adds io.github.randomcodespace.iq.detector.jvm.java.ActiveMqDetector
covering both ActiveMQ Classic (org.apache.activemq.*) and ActiveMQ
Artemis (org.apache.activemq.artemis.*). Both products ship a class
literally named ActiveMQConnectionFactory, so the broker flavour is
disambiguated by import / FQN before emission.

Coverage:
- Connection factories: ActiveMQConnectionFactory,
  ActiveMQQueueConnectionFactory, ActiveMQTopicConnectionFactory,
  ActiveMQJMSConnectionFactory, ActiveMQXAConnectionFactory,
  PooledConnectionFactory.
- Transport URLs: tcp/ssl/nio/udp/vm/amqp/stomp/mqtt/ws/wss with the
  optional +nio / +ssl modifiers, plus failover:(...) / failover:tcp:...
  (the failover transport uses `:(` rather than `://`, handled as a
  separate alternation in BROKER_URL_RE).
- Direct destination instantiation: new ActiveMQQueue("..."),
  new ActiveMQTopic("...").
- session.createQueue("...") / session.createTopic("...") only
  attributed to ActiveMQ when the file already mentions an AMQ import
  or class ref — avoids double-counting against JmsDetector.
- Spring Boot config keys: spring.activemq.broker-url and
  spring.artemis.broker-url in application.properties / application.yml
  (no class context — emits the broker MESSAGE_QUEUE node only).

Emits NodeKind {MESSAGE_QUEUE, QUEUE, TOPIC} with broker properties
("activemq" or "activemq_artemis"), plus EdgeKind
{CONNECTS_TO, SENDS_TO, RECEIVES_FROM} — same shape as IbmMqDetector
and TibcoEmsDetector so the topology view composes cleanly.

Tests: 17 cases covering metadata, early-exit, Classic + Artemis,
named queue/topic producer/consumer, transport URL variants
(failover, pooled), Spring Boot config keys, negative
double-counting against JmsDetector, and a determinism fixture.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Two coupled changes that together let `serve` boot from defaults
without -D / env / config overrides.

1. GraphHealthIndicator: @ConditionalOnBean(GraphStore.class) →
   @Profile("serving"). Spring documents @ConditionalOnBean as fragile
   on user @component classes (its evaluation depends on bean-definition
   ordering during scan). The serving profile already guarantees
   GraphStore is present; @Profile activates earlier and deterministic-
   ally so the readiness-group reference resolves on a clean install.

2. application.yml: management.endpoint.health.validate-group-membership
   set to false. Spring Boot 4 enabled strict group-membership validation
   by default — startup fails when a `health.group.*.include` references
   a profile-conditional bean that hasn't yet been added to the registry
   when the management endpoint config loads. The serving profile's
   readiness include of `graphHealthIndicator` consistently tripped this.
   Disabled per the error message's own remediation hint; missing health
   contributors are silently skipped at probe time, which is the desired
   runtime behaviour.

Verified: `java -jar code-iq-cli.jar serve <path> -p 37779` with no
flags / env / codeiq.yml — port binds, /api/stats returns data without
auth, /actuator/health/readiness returns {"status":"UP"}.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>