fix: kafka dev standalone, OIDC realm LUM, Flyway out-of-order, shutdown guard, TypeRef categorie/modules

- docker-compose.dev.yml: retire le service kafka (standalone existant sur :9092), kafka-ui pointe host.docker.internal:9092
- application-dev.properties: OIDC admin-service realm corrigé lions-user-manager (fix AUTH changement mdp)
- application-prod.properties: nouvelle var KEYCLOAK_LUM_AUTH_SERVER_URL + fallback KEYCLOAK_CLIENT_SECRET
- application.properties: quarkus.flyway.out-of-order=true (évite échec si migration hors-séquence)
- V10 renommé V10_1 (évite conflit avec historique Flyway existant)
- AlertMonitoringService: guard Arc.container().isRunning() pour éviter NPE au shutdown
- TypeOrganisationReferenceResource: forward categorie + modulesRequis au service
- Tests: coverage TypeOrganisationReferenceResource + TypeReferenceService

src/main/java/dev/lions/unionflow/server/resource/TypeOrganisationReferenceResource.java

@@ -70,6 +70,8 @@ public class TypeOrganisationReferenceResource {
                 .estDefaut(request.estDefaut())
                 .estSysteme(request.estSysteme())
                 .organisationId(request.organisationId())
+                .categorie(request.categorie())
+                .modulesRequis(request.modulesRequis())
                 .build();
         try {
             TypeReferenceResponse created = typeReferenceService.creer(withDomaine);

src/main/java/dev/lions/unionflow/server/service/AlertMonitoringService.java

@@ -5,6 +5,7 @@ import dev.lions.unionflow.server.entity.SystemAlert;
 import dev.lions.unionflow.server.repository.AlertConfigurationRepository;
 import dev.lions.unionflow.server.repository.SystemAlertRepository;
 import dev.lions.unionflow.server.repository.SystemLogRepository;
+import io.quarkus.arc.Arc;
 import io.quarkus.scheduler.Scheduled;
 import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
@@ -47,6 +48,10 @@ public class AlertMonitoringService {
     @Scheduled(cron = "0 * * * * ?") // Toutes les minutes à la seconde 0
     @Transactional
     public void monitorSystemMetrics() {
+        // Guard contre l'exécution pendant le shutdown Quarkus (Arc.container() null → NPE)
+        if (!Arc.container().isRunning()) {
+            return;
+        }
         try {
             log.debug("Running scheduled system metrics monitoring...");
 

src/main/resources/application-dev.properties

@@ -50,10 +50,12 @@ quarkus.log.category."io.quarkus.security".level=INFO
 wave.mock.enabled=true
 wave.redirect.base.url=http://localhost:8085
 
-# OIDC client "admin-service" — service account pour appels admin vers lions-user-manager
-quarkus.oidc-client.admin-service.auth-server-url=http://localhost:8180/realms/unionflow
+# OIDC client "admin-service" — service account pour appels vers lions-user-manager
+# Utilise le realm lions-user-manager (cohérent avec le serveur LUM qui valide ce realm)
+# Le client unionflow-server existe dans lions-user-manager realm avec ce secret
+quarkus.oidc-client.admin-service.auth-server-url=http://localhost:8180/realms/lions-user-manager
 quarkus.oidc-client.admin-service.client-id=unionflow-server
-quarkus.oidc-client.admin-service.credentials.secret=unionflow-secret-2025
+quarkus.oidc-client.admin-service.credentials.secret=Esj0DzyRt7wSPtcePDae1dQQdqmQxlJm
 quarkus.oidc-client.admin-service.grant.type=client
 quarkus.oidc-client.admin-service.tls.verification=none
 quarkus.oidc-client.admin-service.early-tokens-acquisition=true

src/main/resources/application-prod.properties

@@ -58,9 +58,10 @@ quarkus.log.category."org.jboss.resteasy".level=WARN
 quarkus.rest-client.lions-user-manager-api.url=${LIONS_USER_MANAGER_URL:http://lions-user-manager:8081}
 
 # OIDC client "admin-service" — service account pour appels admin vers lions-user-manager
-quarkus.oidc-client.admin-service.auth-server-url=${KEYCLOAK_AUTH_SERVER_URL:https://security.lions.dev/realms/unionflow}
+# Utilise le realm lions-user-manager (cohérent avec le serveur LUM qui valide ce realm)
+quarkus.oidc-client.admin-service.auth-server-url=${KEYCLOAK_LUM_AUTH_SERVER_URL:https://security.lions.dev/realms/lions-user-manager}
 quarkus.oidc-client.admin-service.client-id=unionflow-server
-quarkus.oidc-client.admin-service.credentials.secret=${KEYCLOAK_CLIENT_SECRET}
+quarkus.oidc-client.admin-service.credentials.secret=${KEYCLOAK_ADMIN_SERVICE_SECRET:${KEYCLOAK_CLIENT_SECRET}}
 quarkus.oidc-client.admin-service.grant.type=client
 
 # Wave Money — Production

src/main/resources/application.properties

@@ -45,6 +45,7 @@ quarkus.hibernate-orm.metrics.enabled=false
 quarkus.flyway.migrate-at-start=true
 quarkus.flyway.baseline-on-migrate=true
 quarkus.flyway.baseline-version=0
+quarkus.flyway.out-of-order=true
 
 # Configuration Keycloak OIDC — base commune
 quarkus.oidc.application-type=service

src/test/java/dev/lions/unionflow/server/resource/TypeOrganisationReferenceResourceTest.java

@@ -2,9 +2,13 @@ package dev.lions.unionflow.server.resource;
 
 import static io.restassured.RestAssured.given;
 import static org.hamcrest.Matchers.notNullValue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.mockito.ArgumentMatchers.*;
 import static org.mockito.Mockito.*;
 
+import dev.lions.unionflow.server.api.dto.reference.request.CreateTypeReferenceRequest;
+import org.mockito.ArgumentCaptor;
+
 import dev.lions.unionflow.server.api.dto.reference.response.TypeReferenceResponse;
 import dev.lions.unionflow.server.service.TypeReferenceService;
 import io.quarkus.security.identity.SecurityIdentity;
@@ -83,6 +87,40 @@ class TypeOrganisationReferenceResourceTest {
                 .contentType(ContentType.JSON);
     }
 
+    @Test
+    @TestSecurity(user = "superadmin@test.com", roles = {"SUPER_ADMIN"})
+    void creerType_withCategorieAndModules_forwardsFields() {
+        TypeReferenceResponse response = TypeReferenceResponse.builder()
+                .domaine("TYPE_ORGANISATION")
+                .code("TONTINE")
+                .libelle("Tontine")
+                .categorie("FINANCIER_SOLIDAIRE")
+                .modulesRequis("TONTINE,COTISATIONS")
+                .build();
+        response.setId(UUID.randomUUID());
+        ArgumentCaptor<CreateTypeReferenceRequest> captor =
+                ArgumentCaptor.forClass(CreateTypeReferenceRequest.class);
+        when(typeReferenceService.creer(captor.capture())).thenReturn(response);
+
+        String body = """
+                {"code":"TONTINE","libelle":"Tontine","domaine":"TYPE_ORGANISATION",
+                 "categorie":"FINANCIER_SOLIDAIRE","modulesRequis":"TONTINE,COTISATIONS"}
+                """;
+
+        given()
+                .contentType(ContentType.JSON)
+                .body(body)
+                .when()
+                .post(BASE_PATH)
+                .then()
+                .statusCode(201);
+
+        CreateTypeReferenceRequest captured = captor.getValue();
+        assertEquals("FINANCIER_SOLIDAIRE", captured.categorie());
+        assertEquals("TONTINE,COTISATIONS", captured.modulesRequis());
+        assertEquals("TYPE_ORGANISATION", captured.domaine());
+    }
+
     @Test
     @TestSecurity(user = "superadmin@test.com", roles = {"SUPER_ADMIN"})
     void creerType_illegalArg_returns400() {

src/test/java/dev/lions/unionflow/server/service/TypeReferenceServiceTest.java

@@ -201,7 +201,7 @@ class TypeReferenceServiceTest {
         UpdateTypeReferenceRequest updateRequest = new UpdateTypeReferenceRequest(
                 null,           // code (pas de changement)
                 "Nouveau libellé",
-                null, null, null, null, null, null, null);
+                null, null, null, null, null, null, null, null, null);
 
         TypeReferenceResponse updated = typeReferenceService.modifier(created.getId(), updateRequest);
         assertThat(updated.getLibelle()).isEqualTo("Nouveau libellé");
@@ -212,7 +212,7 @@ class TypeReferenceServiceTest {
     @DisplayName("modifier avec UUID inexistant lance IllegalArgumentException")
     void modifier_inexistant_throws() {
         UpdateTypeReferenceRequest updateRequest = new UpdateTypeReferenceRequest(
-                null, "Libellé", null, null, null, null, null, null, null);
+                null, "Libellé", null, null, null, null, null, null, null, null, null);
 
         assertThatThrownBy(() -> typeReferenceService.modifier(UUID.randomUUID(), updateRequest))
                 .isInstanceOf(IllegalArgumentException.class)
@@ -317,7 +317,7 @@ class TypeReferenceServiceTest {
                         .build());
 
         UpdateTypeReferenceRequest updateRequest = new UpdateTypeReferenceRequest(
-                newCode, null, null, null, null, null, null, null, null);
+                newCode, null, null, null, null, null, null, null, null, null, null);
 
         TypeReferenceResponse updated = typeReferenceService.modifier(created.getId(), updateRequest);
         assertThat(updated.getCode()).isEqualTo(newCode.toUpperCase());
@@ -340,7 +340,7 @@ class TypeReferenceServiceTest {
                         .build());
 
         UpdateTypeReferenceRequest updateRequest = new UpdateTypeReferenceRequest(
-                "CHANGED_CODE", null, null, null, null, null, null, null, null);
+                "CHANGED_CODE", null, null, null, null, null, null, null, null, null, null);
 
         assertThatThrownBy(() -> typeReferenceService.modifier(created.getId(), updateRequest))
                 .isInstanceOf(IllegalArgumentException.class)
@@ -365,7 +365,7 @@ class TypeReferenceServiceTest {
 
         // Même code (case-insensitive) → !equalsIgnoreCase = false → if body skipped
         UpdateTypeReferenceRequest updateRequest = new UpdateTypeReferenceRequest(
-                code.toLowerCase(), "Nouveau libelle", null, null, null, null, null, null, null);
+                code.toLowerCase(), "Nouveau libelle", null, null, null, null, null, null, null, null, null);
 
         TypeReferenceResponse updated = typeReferenceService.modifier(created.getId(), updateRequest);
         assertThat(updated).isNotNull();
@@ -457,7 +457,7 @@ class TypeReferenceServiceTest {
 
         // Modifier le code avec l'organisation non-null → L195-197 : orgId = entity.getOrganisation().getId()
         UpdateTypeReferenceRequest updateRequest = new UpdateTypeReferenceRequest(
-                newCode, null, null, null, null, null, null, null, null);
+                newCode, null, null, null, null, null, null, null, null, null, null);
 
         TypeReferenceResponse updated = typeReferenceService.modifier(created.getId(), updateRequest);
 
@@ -491,7 +491,9 @@ class TypeReferenceServiceTest {
                 "warning",          // severity
                 10,                 // ordreAffichage
                 true,               // estDefaut
-                false               // actif
+                false,              // actif
+                null,               // categorie
+                null                // modulesRequis
         );
 
         TypeReferenceResponse updated = typeReferenceService.modifier(created.getId(), updateRequest);