Core service returned 500 on /api/auth/register and /api/auth/login because no Jakarta Bean Validation provider was on the classpath. This blocked all authenticated API endpoints.
