refactor (jspecify): roll @NullMarked out to all sub-packages

[adityamparikh]

Summary

Extends JSpecify null-safety enforcement from the single root package org.apache.solr.mcp.server to every sub-package in the codebase — main and test alike.

Before this change, NullAway:OnlyNullMarked=true was silently skipping all production code except the (mostly empty) root package. So the project advertised null-safety but only enforced it on Main.java.

Supersedes #109 and #115 — both are subsets of this rollout:

• fix: add JSpecify @Nullable annotations to SearchService parameters #109 (search package only): the search/package-info.java, SearchResponse.maxScore, and SearchService.search parameter annotations are byte-for-byte included here.
• fix: add JSpecify @Nullable annotations for accurate null contracts #115 (DTOs + utils + service returns): all Dtos.java, CollectionUtils.get{Long,Float,Integer}, CollectionService cache/handler method returns, and JsonResponseParser.convertValue annotations are included here. (The SolrConfig#useHttp1_1(true) change that rode along with fix: add JSpecify @Nullable annotations for accurate null contracts #115 has already landed separately via fix(solr): force HTTP/1.1 in SolrJ client to avoid flaky H2 EOF #130.)

Changes

1. package-info.java with @NullMarked added to 10 packages (8 main + 2 test-only):

   • main: .collection, .config, .indexing, .indexing.documentcreator, .metadata, .search, .security, .util
   • test-only: .containerization, .observability

2. Production code annotated with @Nullable where appropriate, derived from running NullAway:

   • CollectionUtils.getLong/getFloat/getInteger — return null on missing/unparseable
   • CollectionService cache/handler metrics methods — return null when the Solr endpoint is unavailable (graceful degradation by design)
   • Many Dtos.java record components: SolrMetrics.{cacheStats,handlerStats}, all of CacheStats/CacheInfo/HandlerStats/HandlerInfo, SolrHealthStatus.{errorMessage,responseTime,totalDocuments,solrVersion,status}, IndexStats.{numDocs,segmentCount}
   • @McpToolParam(required = false) parameters on CollectionService.createCollection and SearchService.search
   • JsonResponseParser.convertValue — JSON null inputs
   • CollectionService.isCacheStatsEmpty — accepts @nullable

3. HttpSecurityConfiguration Spring @Value fields initialised with defaults ("" for issuerUrl matching the property default, List.of() for allowedOrigins) so the analyser can see they are always non-null after construction.

4. NullAway is explicitly disabled on compileTestJava (one-line in build.gradle.kts with explanatory comment).

   • The rollout exposes ~30 test sites that unbox or dereference values now declared @Nullable in production (Map.get returns, optional metric fields, etc.).
   • Each can be tightened by extracting to a local + assertNotNull, but the volume makes test-side cleanup a deliberate follow-up.
   • Production code is fully enforced.

Test plan

• ./gradlew build — full build green (compile + unit + integration)
• NullAway enforces null safety on all production code
• Pre-existing tests still pass at runtime

🤖 Generated with Claude Code