fix(hardening): H2 enum-leak & H3 blank-password validation

[WolfTasks]

Two small backend hardening fixes from the #3 final-review backlog (H2, H3).
Each was prepared as its own spec+plan under docs/superpowers/ and executed TDD.

H2 — Notification-Prefs PUT no longer leaks the enum FQCN

NotificationPreferenceController.update used NotificationType.valueOf(it.type); on an
unknown type the resulting IllegalArgumentException was mapped to 400 but its message
echoed No enum constant com.taskowolf…NotificationType.<X>, leaking the fully qualified
enum name. Now the type is resolved against NotificationType.entries and a controlled
BadRequestException("Unknown notification type: <X>") is thrown on miss. Still HTTP 400;
valid types behave exactly as before. The global IllegalArgumentException handler is left
untouched.

H3 — Reject whitespace-only passwords

ChangePasswordRequest.newPassword and RegisterRequest.password had @Size(min = 8) but
no @NotBlank, so eight spaces passed validation. Added @NotBlank alongside @Size on
both fields. Both endpoints already carry @Valid, so the constraint takes effect
immediately (no controller change). Scope decision: fixed both DTOs for consistency, not
just change-password.

Tests

• H2: 2 new MockK controller unit tests (asserts no com.taskowolf/No enum constant in the
  message; valid-only path still updates).
• H3: 4 new direct Bean-Validation unit tests (jakarta.validation.Validator) — blank rejected,
  valid accepted, for both DTOs. No Spring context/JWT needed.
• Full backend suite green (incl. Postgres testcontainer integration tests).

Specs/plans: docs/superpowers/specs/2026-07-10-h2-* / -h3-* and matching plans/ (on local main).

🤖 Generated with Claude Code