refactor(dtos): convert all DTOs to Java records for native-mode Jackson

En Quarkus native-image, Jackson no introspecta public fields de clases
con normales (deja de refleccionar field metadata). Salia error:

  No serializer found for class com.l2.shots.auth.AuthMeResponse and
  no properties discovered to create BeanSerializer

Los records tienen auto-accessors (id(), username(), etc) que Jackson
serializa nativamente, sin necesidad de reflection o
@RegisterForReflection.

Convertidos:
- auth: AuthMeResponse, AdminUserSummary, Credentials,
         ChangePasswordRequest, AdminResetPasswordRequest, ErrorBody,
         MustChangeBody
- history: RunSummary, RunDetails, RunItem, RunSnapshot, RunIn,
           HistoryStats
- state: AppState (con Insumos y FormulaDto anidados)

Callers actualizados para usar accessors en vez de field access:
- AuthService.listUsersForAdmin -> AdminUserSummary.from
- AuthService.saveRun -> RunSummary.from / RunDetails.of
- AuthResource.register/login -> creds.username() / creds.password()
- HistoryResource.saveRun -> input.items() etc

Notas:
- RunDetails NO puede extender RunSummary en records (JLS no permite
  extends entre records). Va como record independiente con todos los
  campos. El JSON que produce matchea la interface RunDetails del
  frontend (que extendia RunSummary).
- HistoryStats ahora se construye de una sola vez al final de
  computeStats en lugar de ir mutando campos.
- MustChangeBody quedo con un constructor no-canonico no-arg para
  mantener el call site original (new MustChangeBody()).

src/main/java/com/l2/shots/auth/AuthResource.java

@@ -42,7 +42,7 @@ public class AuthResource {
     @POST
     @Path("/register")
     public Response register(Credentials creds) {
-        Optional<User> result = authService.register(creds.username, creds.password);
+        Optional<User> result = authService.register(creds.username(), creds.password());
         if (result.isEmpty()) {
             return Response.status(409)
                     .entity(new ErrorBody("username no disponible o datos inválidos"))
@@ -58,7 +58,7 @@ public class AuthResource {
     @POST
     @Path("/login")
     public Response login(Credentials creds) {
-        Optional<User> result = authService.authenticate(creds.username, creds.password);
+        Optional<User> result = authService.authenticate(creds.username(), creds.password());
         if (result.isEmpty()) {
             return Response.status(401)
                     .entity(new ErrorBody("credenciales inválidas"))
@@ -83,7 +83,7 @@ public class AuthResource {
     @Path("/change-password")
     @Authenticated
     public Response changePassword(@Context HttpHeaders headers, ChangePasswordRequest body) {
-        if (body == null || body.currentPassword == null || body.newPassword == null) {
+        if (body == null || body.currentPassword() == null || body.newPassword() == null) {
             return Response.status(400).entity(new ErrorBody("Faltan campos requeridos")).build();
         }
         Optional<JsonWebToken> jwt = jwtCookieAuth.extractToken(headers);
@@ -91,7 +91,7 @@ public class AuthResource {
         Optional<User> user = authService.getEntityFromToken(jwt.get());
         if (user.isEmpty()) return Response.status(401).build();
         AuthService.ChangePasswordResult result = authService.changePassword(
-                user.get().id, body.currentPassword, body.newPassword);
+                user.get().id, body.currentPassword(), body.newPassword());
         switch (result) {
             case OK:
                 User refreshed = User.findById(user.get().id);
@@ -116,7 +116,7 @@ public class AuthResource {
     @Path("/admin/reset-password")
     @RolesAllowed("admin")
     public Response adminResetPassword(AdminResetPasswordRequest body) {
-        if (body == null || body.username == null || body.newPassword == null) {
+        if (body == null || body.username() == null || body.newPassword() == null) {
             return Response.status(400).entity(new ErrorBody("Faltan campos requeridos")).build();
         }
         UUID requesterId;
@@ -125,7 +125,7 @@ public class AuthResource {
         } catch (Exception e) {
             return Response.status(401).build();
         }
-        boolean ok = authService.resetPasswordAsAdmin(requesterId, body.username, body.newPassword);
+        boolean ok = authService.resetPasswordAsAdmin(requesterId, body.username(), body.newPassword());
         if (!ok) {
             return Response.status(400).entity(new ErrorBody("Usuario no encontrado o contraseña inválida")).build();
         }
@@ -180,9 +180,6 @@ public class AuthResource {
                 .build();
     }
 
-    public static class ErrorBody {
-        public String error;
-        public ErrorBody() {}
-        public ErrorBody(String error) { this.error = error; }
+    public record ErrorBody(String error) {
     }
 }