fix: resolve top 5 SonarQube issues (weekly sweep)

[devin-ai-integration]

Summary

Weekly SonarQube code quality sweep resolving the top 5 open issues ranked by severity, type, effort, and recency.

Issues Fixed

#	SonarQube Key	Severity	Rule	File	Description	Fix
1	AZ1u3HBdEnUkF3fpjVtN	CRITICAL	java:S1948	InvalidRequestException.java:7	Non-serializable field errors in serializable class	Made field transient
2	AZ1u3HCaEnUkF3fpjVtj	CRITICAL	java:S1452	ArticleApi.java:36	Generic wildcard type ResponseEntity<?>	Replaced with ResponseEntity<Map<String, Object>>
3	AZ1u3HCaEnUkF3fpjVtk	CRITICAL	java:S1452	ArticleApi.java:45	Generic wildcard type ResponseEntity<?>	Replaced with ResponseEntity<Map<String, Object>>
4	AZ1u3HBkEnUkF3fpjVtQ	CRITICAL	java:S1452	CommentsApi.java:41	Generic wildcard type ResponseEntity<?>	Replaced with ResponseEntity<Map<String, Object>>
5	AZ1u3HAmEnUkF3fpjVtC	MAJOR	java:S2885	DateTimeHandler.java:18	Static Calendar field is not thread-safe	Replaced with factory method utcCalendar() that returns a new instance per call

Ranking Criteria

1. Severity (CRITICAL before MAJOR)
2. Type (S1948 is a serialization BUG, ranked above S1452 CODE_SMELLs; S2885 is a thread-safety BUG)
3. Effort (all are quick, focused fixes)
4. Recency (tiebreaker)

Review & Testing Checklist for Human

• Verify InvalidRequestException serialization behavior is unaffected (field is only accessed via getErrors(), not serialized)
• Verify ArticleApi and CommentsApi endpoints still return correct JSON responses (the concrete return type Map<String, Object> matches what articleResponse()/commentResponse() already return)
• Verify DateTimeHandler still correctly handles UTC timestamps in database operations (factory method returns identical Calendar instances)

Notes

• All 265 open SonarQube issues were evaluated. The 4 CRITICAL-severity issues plus the highest-priority MAJOR BUG were selected.
• spotlessCheck and all tests pass locally.
• The SonarQube project key is choikh0423_demo-spring-boot-test-coverage (same codebase as COG-GTM/spring-boot-realworld-example-app).

Link to Devin session: https://app.devin.ai/sessions/48a78a8fd8d6475ba32055fbaff86e9f
Requested by: @choikh0423

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.