feat(hint): add admin hints for the dashboard

readme.md

@@ -54,6 +54,10 @@ To Be Played is split into three repositories:
   (`users.enabled`; blocking ends every login, the login then answers `403 ACCOUNT_BLOCKED`, but only after the
   right password), delete (the same flag and nightly cleanup as "Delete my account"). No action on the own account
   or on another admin. Every action and every "view as" is a row in `admin_audit`.
+- **Dashboard hints**: a PLATFORM_ADMIN writes a hint for all users (plain text in English, German optional, start
+  and end time, type `DISMISS` or `ACCEPT`). The dashboard shows the running hints one at a time, newest first.
+  "Do not show again" on a `DISMISS` hint or "OK" on an `ACCEPT` hint is a row in `hint_done`, so the hint never
+  comes back for this user on any device. Creating and ending a hint are rows in `admin_audit`.
 - **Delete my account** with the password (5 wrong tries per 15 minutes, then `429`). It only sets
   `users.deleted_at` and revokes every refresh token: from then on no login, no refresh, no public profile, no Steam
   link, not in the landing stats. Email and display name stay taken; the Steam ID is freed, so an undo needs a
@@ -77,6 +81,11 @@ To Be Played is split into three repositories:
 | `GET` | `/api/admin/users?query=&page=&size=` (`{content, page, size, totalElements, totalPages}`) | PLATFORM_ADMIN |
 | `PUT` | `/api/admin/users/{id}/blocked` (`{blocked}`; `409 SELF_ACTION`, `TARGET_IS_ADMIN`, `ALREADY_DELETED`) | PLATFORM_ADMIN |
 | `DELETE` | `/api/admin/users/{id}` (`409 SELF_ACTION`, `TARGET_IS_ADMIN`) | PLATFORM_ADMIN |
+| `GET` | `/api/hints` (`{results}`: running hints not closed for good, newest first) | access token |
+| `PUT` | `/api/hints/{id}/done` (`204`; `404 HINT_NOT_FOUND`) | access token |
+| `GET` | `/api/admin/hints` (`{results}` with `status` PLANNED/ACTIVE/ENDED by the server clock and `doneCount`, newest first) | PLATFORM_ADMIN |
+| `POST` | `/api/admin/hints` (`{textEn, textDe, kind, startsAt, endsAt}`; `201 {id}`, `400 INVALID_HINT`) | PLATFORM_ADMIN |
+| `PUT` | `/api/admin/hints/{id}/end` (`204`; a planned hint never starts) | PLATFORM_ADMIN |
 | `DELETE` | `/api/users/me` (`{password}`; `204` and both cookies cleared, `403 INVALID_PASSWORD`, `429`) | access token |
 | `GET` | `/api/steam-link/callback` | public, Steam's redirect back; binding cookie; redirects to the frontend settings |
 | `PUT` | `/api/users/settings/appearance` | access token |
@@ -114,6 +123,8 @@ through `CoreAccountService`.
 `admin` (users page, audit) works the same way. It deletes through the port `shared/account/AccountDeleter`, and
 the login module writes "view as" to the audit table through `shared/audit/AdminAuditLog`, because modules never
 use each other.
+`hint` (dashboard hints and their admin API) uses `JdbcTemplate` in a `repo` package too, and audits through
+`shared/audit/AdminAuditLog`.
 
 ArchUnit enforces these rules in `src/test/java/auth_service/architecture/ArchitectureTest.java`, so a layer
 violation fails the build. It also keeps the modules independent of each other and free of cycles. Test base