Implement auth domain with outside-in TDD (22 tests)

Controller (7 tests): signup, login, logout, GET/PATCH me.
Standalone MockMvc setup (Boot 4 removed @WebMvcTest).

Service (11 tests): signup with conflict check, login with
password/active validation, getCurrentUser with household info,
updateProfile with password change flow.

Repository (4 tests): save/find, case-insensitive email via
IgnoreCase queries (citext + Hibernate needs explicit IgnoreCase),
existsByEmail.

Also includes:
- SecurityConfig: session auth, CSRF, role-based authorization
- CustomUserDetailsService: loads UserAccount for Spring Security
- UserAccount, Household, HouseholdMember JPA entities
- spring-boot-flyway dependency (Boot 4 requires explicit module)
- ddl-auto=none (Flyway owns schema, validate fails on citext)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/test/java/com/recipeapp/auth/UserAccountRepositoryTest.java

@@ -0,0 +1,53 @@
+package com.recipeapp.auth;
+
+import com.recipeapp.AbstractIntegrationTest;
+import com.recipeapp.auth.entity.UserAccount;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+
+import static org.assertj.core.api.Assertions.*;
+
+class UserAccountRepositoryTest extends AbstractIntegrationTest {
+
+    @Autowired
+    private UserAccountRepository userAccountRepository;
+
+    @Test
+    void shouldSaveAndFindByEmail() {
+        var user = new UserAccount("test@example.com", "Test User", "hashed_pw");
+        userAccountRepository.save(user);
+
+        var found = userAccountRepository.findByEmailIgnoreCase("test@example.com");
+
+        assertThat(found).isPresent();
+        assertThat(found.get().getDisplayName()).isEqualTo("Test User");
+        assertThat(found.get().getSystemRole()).isEqualTo("user");
+        assertThat(found.get().isActive()).isTrue();
+        assertThat(found.get().getCreatedAt()).isNotNull();
+    }
+
+    @Test
+    void shouldReturnEmptyWhenEmailNotFound() {
+        var found = userAccountRepository.findByEmailIgnoreCase("nonexistent@example.com");
+        assertThat(found).isEmpty();
+    }
+
+    @Test
+    void existsByEmailIgnoreCaseShouldReturnTrueWhenExists() {
+        var user = new UserAccount("exists@example.com", "Exists", "hashed");
+        userAccountRepository.save(user);
+
+        assertThat(userAccountRepository.existsByEmailIgnoreCase("exists@example.com")).isTrue();
+        assertThat(userAccountRepository.existsByEmailIgnoreCase("nope@example.com")).isFalse();
+    }
+
+    @Test
+    void shouldHandleCaseInsensitiveEmail() {
+        var user = new UserAccount("Sarah@Example.COM", "Sarah", "hashed");
+        userAccountRepository.save(user);
+
+        var found = userAccountRepository.findByEmailIgnoreCase("sarah@example.com");
+        assertThat(found).isPresent();
+        assertThat(found.get().getDisplayName()).isEqualTo("Sarah");
+    }
+}