fix: add role-based access control to all Java services

[Senthil455]

Problem

All Java services (payroll, performance, leave) had no role-based access control on ~95% of endpoints. The existing InternalAuthFilter sets x-user-role as a request attribute, but no enforcement was applied at the controller level. The two ad-hoc checks that existed read from X-User-Role header instead of the request attribute set by the filter, making them ineffective.

Solution

Implemented declarative RBAC via a @RequiresRole annotation with an AOP aspect in all 3 Java services.

Architecture

• @RequiresRole({"admin", "hr", ...}) placed on controller methods
• RoleAspect - Spring AOP @around advice intercepts annotated methods, reads x-user-role from the request attribute (set by InternalAuthFilter), and returns 403 if the caller role is not allowed
• spring-boot-starter-aop dependency added to all 3 pom.xml files

Endpoints protected

• Payroll (~30 endpoints): admin-only for bank transactions, bonuses, equity, tax config, compliance; HR/admin for compensation, benchmarks, forecasts
• Performance (6 controllers, ~30 endpoints): admin/hr for succession/candidates; admin/hr/manager for goal/review CRUD; all roles for recognition/feedback
• Leave (4 endpoints): admin/hr/manager for status approval; all roles for submitting and viewing own requests

Fixes

• Replaced broken @RequestHeader(X-User-Role) in PayrollController and LeaveController with proper attribute-based role resolution