Reactive Spring Security binding: principal projection, ReactiveSecurityContext access, and the URL policy enforcement point

Reactive method security: @EnableReactiveMethodSecurity plus the @Secure interceptor backed by the core authorization evaluator

Secure-by-default reactive OAuth2 resource server: JWT (and opaque) validation, claim-to-authority mapping, default-deny chain and hardened security headers. Delivered to applications via the application starter.

Test fixtures for the security platform: principal factories and a configurable fake PolicyDecisionPort