Play Framework

fix: fifth audit pass — Netty 4.2 review, VT review, in-flight fixes

Bundles three workstreams that landed together. Granular split via interactive
rebase is possible but the file-level overlap (PlayHandler etc.) makes it lossy.

== 1. Netty 4.2.x review-driven fixes ==

- Server: register EventLoopGroups for shutdownGracefully via a JVM hook;
  boss group sized to 1 (was 2 × cores); restore play.netty.maxThreads
- SslHttpServerPipelineFactory: Logger.error throwable-first overload (was
  swallowing stack traces); drop redundant setEnableSessionCreation(true)
- PlayHandler: WebSocketInvocation now calls cleanupSpooledBody (parity with
  NettyInvocation); SPOOLED_BODY contract documented at the read site;
  wss:// scheme advertised when SslHandler is present;
  play.netty.ws.allowExtensions toggle for permessage-deflate; class-based
  ChunkedWriteHandler lookup; isKeepAlive HTTP/1.1-guard rationale comment;
  setContentLength delegates to HttpUtil
- StreamChunkAggregator: defensive parseInt/parseLong on construction so a
  typo in play.netty.spoolThresholdBytes / maxContentLength doesn't kill
  every accepted connection
- New StreamChunkAggregatorTest: 12 EmbeddedChannel cases covering spool
  threshold, 413 oversize, 400 decoder-failure, 100-Continue, TE-chunked
  stripping, defensive parse, FullHttpRequest passthrough, channelInactive
  cleanup
- application-skel: document play.netty.maxThreads (restored toggle) and
  play.netty.ws.allowExtensions (new toggle)

== 2. VT audit conflict resolutions on top of feat/vt-audit-fixes ==

The VT audit fixes were merged in c4f754a57. Two files had pre-existing
in-flight changes that needed integration with the merged versions:

- VirtualThreadConfig.isSubsystemEnabled: combine M16 (null-guard for
  Play.configuration to protect test paths) + M2 (treat blank/whitespace
  override as "inherit from global", not as explicit "false")
- VirtualThreadScheduledExecutor.scheduleWithFixedDelay: combine M14
  (use isDone() so abnormal-termination short-circuits the same as
  cancellation) + H1 (split shutdown branch so a scheduler shutdown
  between runs drives the handle to terminal state via cancel(false),
  preventing callers from blocking on get() forever)

== 3. Pre-existing in-flight audit work ==

Approximately 50 files spanning classloader, data binding, validation,
db/jpa, mvc, server, libs, mail, security, and CLI tooling. New tests
under test-src for SecretLockdown, URLCheck, SqlQuery quoting,
LangConcurrency. Continuation of the PF-NN audit pattern from prior
passes (PF-30 through PF-66 + earlier).

== Verification ==

- ant compile: clean
- ant unittest: full suite green prior to commit (151 tests + 12 new
  StreamChunkAggregator + 19 new VT tests = 182 cases)

Snapshot of the pre-commit state preserved at branch
wip/uncommitted-pre-cleanup (commit 023152909) and stash@{0}.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>