The circular-dependency that originally forced @AllArgsConstructor was removed when changePassword orchestration moved into the controller. No cycle now exists between UserController, UserService, AuthService, or AuditService — final fields and constructor injection are safe again. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>