Move treasury-rest-api to Spring Boot 4.1.0 GA + refresh REST dependencies

The module was migrated to Spring Boot 4 during a test and left on the early 4.0.3 pre-GA pin (root build.gradle.kts:15). Move it onto the latest GA of the 4.x line and bring treasury-rest-api's own (inline) dependencies up to date — preferring BOM-managed versions over hard pins — and make the code changes the upgrade requires. Addresses the pre-release-pin half of ADT-19 (the missing test-CI job in ADT-19 is out of scope here).

Done

• Spring Boot 4.0.3 → 4.1.0 (Spring Framework 7.0.8), root build.gradle.kts. 4.1.0 GA (2026-06-10), OSS support through Jul 2027. io.spring.dependency-management 1.1.7 already latest.
• bucket4j 8.14.0 → 8.19.0 (core/caffeine/redis-common/lettuce).
• springdoc-openapi-starter-webmvc-ui 3.0.1 → 3.0.3.
• Caffeine: dropped the explicit 3.1.8 pin — now BOM-managed (3.2.4).
• Lettuce: dropped the explicit pin entirely — now BOM-managed (7.5.2), moving off the old 6.x. Verified safe by bytecode linkage: bucket4j_jdk17-lettuce 8.19 declares lettuce 6.x only as a provided compile floor, but every lettuce symbol it actually calls (RedisClient.connect, StatefulRedisConnection.async, RedisAsyncCommands.eval/del/get, ScriptOutputType, RedisException ctors, RedisFuture ⊂ Future+CompletionStage) exists unchanged in lettuce 7.
• mybatis-spring-boot-starter 4.0.1, micrometer-registry-prometheus (BOM 1.17.0), mariadb-java-client (BOM 3.5.8) — already current.

Code changes required by the upgrade

• Spring Framework 7 deprecated HttpStatus.UNPROCESSABLE_ENTITY (renamed UNPROCESSABLE_CONTENT, RFC 9110). Updated all 5 usages (3 main: TransferService ×2, AdminFirmService; 2 test assertions in lockstep — distinct enum constants).
• bucket4j 8.19 deprecated the whole LettuceBasedProxyManager.builderFor(...) factory family. Rewrote LettuceBucketProvider to Bucket4jLettuce.casBasedBuilder(redisClient) with expiry via expirationAfterWrite(...) (the ClientSideConfig wrapper was removed), dropping the manual connect(ByteArrayCodec).

Verification

./gradlew :treasury-rest-api:build green — compile, full MariaDB4j IT suite, bootJar — with no upgrade-related deprecation warnings remaining (residual AssertJ catchThrowableOfType deprecation is pre-existing, BOM-managed).

Monorepo-wide shared version-catalog upgrade (junit 6, HikariCP 7, flyway 12, jjwt, mariadb4j, mockito, etc.) is tracked separately — see sibling issue.