[FEAT/#116] 웹 어드민 페이지용 서버 세션 기반 인증 체계 구축

[ckkim817]

💡 Issue

• resolved: [FEAT] 웹 어드민 페이지용 서버 세션 기반 인증 체계 구축 #116

📄 Description

• 웹 어드민 페이지에서 사용될 서버 세션 기반 인증 체계를 구축했습니다.
• CSRF 토큰 발급 API를 구현했습니다.
• 로그인/로그아웃 API를 구현했습니다.

[Copilot]

Pull Request Overview

This PR implements server session-based authentication for the web admin page, replacing custom JWT authentication handlers with more appropriately named ones and adding comprehensive admin authentication infrastructure.

• Refactored JWT authentication components with clearer naming conventions
• Added admin authentication system with session management, CSRF protection, and dedicated handlers
• Introduced admin entity, repository, and controller for CSRF token management

Reviewed Changes

Copilot reviewed 17 out of 19 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
SpotService.java	Updated error type from UN_LOGIN_ERROR to UNAUTHORIZED_ERROR for consistency
GlobalExceptionHandler.java	Fixed package declaration and removed redundant imports
ErrorType.java	Added new admin-specific error types and renamed UN_LOGIN_ERROR to UNAUTHORIZED_ERROR
WebConfig.java	Added CORS configuration for admin endpoints
SecurityConfig.java	Restructured security with separate filter chains for API and admin, added session management
JwtTokenProvider.java	Minor formatting cleanup
JwtAuthenticationFilter.java	Updated reference to renamed authentication entry point
JwtAuthenticationEntryPoint.java	Renamed from CustomJwtAuthenticationEntryPoint and cleaned up formatting
JwtAccessDeniedHandler.java	Renamed from CustomAccessDeniedHandler and cleaned up formatting
AdminUserDetailsService.java	New service for loading admin user details
AdminAuthenticationEntryPoint.java	New entry point for admin authentication failures
AdminAccessDeniedHandler.java	New handler for admin access denied scenarios with CSRF support
AdminRepository.java	New repository for admin entity operations
AdminEntity.java	New entity representing admin users
CsrfTokenResponse.java	New response DTO for CSRF token information
AdminController.java	New controller providing CSRF token endpoint
prepare-commit-msg	Script improvements with better shell practices

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

The @value annotation should include a default value or the property should be documented. Consider adding a default value like @Value(\"${cors.allowed-origins:http://localhost:3000}\") to prevent application startup failures if the property is not configured.

Suggested change

	@Value("${cors.allowed-origins}")
	@Value("${cors.allowed-origins:http://localhost:3000}")

[Copilot]

The TODO comment indicates a pending architectural change to Redis-based sessions. Consider creating a GitHub issue to track this technical debt and include the issue number in the comment for better traceability.

Suggested change

	.deleteCookies("JSESSIONID")) // TODO: 추후 Spring Session – Redis (SESSION) 으로 전환하여 무중단 배포 지원
	.deleteCookies("JSESSIONID")) // TODO (GitHub #42): 추후 Spring Session – Redis (SESSION) 으로 전환하여 무중단 배포 지원

[Copilot]

The BCrypt strength of 12 is quite high and may cause performance issues during authentication. Consider using the default strength (10) unless there's a specific security requirement that justifies the higher computational cost.

Suggested change

	return new BCryptPasswordEncoder(12);
	return new BCryptPasswordEncoder();