chore(backend): eliminate remaining @Suppress debt in main+shared (successor of #1019)

[ryuknull]

Context

Successor of #1019, which was closed after its first batch with the bulk of the scope untouched. Batches shipped so far harvested only provably-dead annotations (5 deletions + 1 narrowing via #1037, #1044; #1045 recorded 4 more as verified-live with lint proof). The durable record lives in openspec/specs/code-hygiene/spec.md. Everything below is the remaining live-suppression debt, which can only be removed by refactoring the code, not by deleting annotations.

Verified inventory (2026-09-14, main)

• ~173 suppression lines (@Suppress + @file:Suppress) across server/smp/src/main and shared/*/src/main (production code only; src/test is explicitly out of scope)
• Heavy foci, all confirmed present:

File	Suppressions
publishing/application/BulkPublishingHandlers.kt	@file:Suppress (11 rules) + LongParameterList
publishing/domain/BulkValidationPipeline.kt	multi-rule @Suppress (~10 rules)
publishing/application/PublicationCreationService.kt	@file:Suppress + LongParameterList
publishing/infrastructure/scheduling/PublishingWorker.kt	LargeClass, LongMethod x3, TooGenericExceptionCaught x3
publishing/infrastructure/http/PublishingProblemDetailsHandler.kt	13 (mostly UNUSED_PARAMETER)
identity/infrastructure/http/IdentityProblemDetailsHandler.kt	12 (mostly UNUSED_PARAMETER)
platform/infrastructure/http/PlatformProblemDetailsHandler.kt	4
media/infrastructure/unsplash/UnsplashWebClient.kt	3 (TooGenericExceptionCaught cluster)
media/infrastructure/health/MediaHealthConfiguration.kt	2 (TooGenericExceptionCaught)
mcp/infrastructure/McpAuditEmitter.kt	TooGenericExceptionCaught
platform/infrastructure/bus/SpringDomainEventPublisher.kt	2 (cluster)
tenancy/publishing ThrowsCount/LongMethod, R2DBC StringLiteralDuplication	per-file triage

Recorded deferred debt (do NOT re-triage without cause): StaleAssetReconciler.kt:96 (baseline-coupled), TransferWorkspaceOwnershipHandler LongMethod, UpdateWorkspaceMembershipStatusHandler.kt:25 (ThrowsCount, 4 counted throws), plus the 4 Lote-3 verified-live sites — see openspec/specs/code-hygiene/spec.md.

Scope and rules

• Small batches per context (publishing, identity, media, mcp, platform, governance). Each batch removes suppressions by fixing the code (hexagonal responsibility extraction, guards, value types) — never by silencing.
• Deletion-only sweeps of new dead candidates use the lightweight lint-oracle loop (delete → just backend-lint decides); refactor batches use the full SDD cycle.
• Never hand-edit or regenerate detekt-baseline.xml outside a tool run; never change config/detekt/detekt.yml; zero new @Suppress (ForbiddenSuppress stays clean).

Acceptance criteria

• Total suppression count in production code decreases every batch
• just backend-lint PASS with no bypasses per batch
• just backend-check PASS per batch (arch tests green)
• detekt-baseline.xml gains zero new entries

Verification

just backend-lint / just backend-check; local vs CI evidence reported separately.

[linear-code]

DALLAY-596