build(quality): enforce unused imports, missing javadoc and crud verbs

upgrade checkstyle from a naming-only ruleset to a public-api gate:

- unusedimports: dead imports fail the build (zero violations existed
  at adoption)
- missingjavadoctype/method: public types and members must carry
  javadoc (scope public, @override exempt) - about 140 doc comments
  were added across records, filters, stores and gRPC servers
- method name format now rejects find/query/fetch prefixes, encoding
  the repo crud verb law (select stays reserved for mybatis mappers
  and is policed by review)
- suppressions: skip protobuf generated-sources, which only enter the
  scan in full-reactor builds
- spotless: ratchet checks to origin/main so legacy formatting debt
  stops blocking unrelated changes and CI formats only what changed

checkstyle-suppressions.xml

@@ -19,4 +19,6 @@
         "https://checkstyle.org/dtds/suppressions_1_2.dtd">
 <suppressions>
     <suppress files="org[\\/]openscada[\\/]opc[\\/].*" checks=".*"/>
+    <!-- protobuf/gRPC stubs are generated into target/generated-sources -->
+    <suppress files=".*[\\/]generated-sources[\\/].*" checks=".*"/>
 </suppressions>

checkstyle.xml

@@ -28,7 +28,12 @@
     <module name="TreeWalker">
         <!-- Naming conventions -->
         <module name="TypeName"/>
-        <module name="MethodName"/>
+        <!-- CRUD verb convention (AGENTS.md): find*/query*/fetch* are not used;
+             select* stays reserved for MyBatis mapper calls in *ManagerImpl, so it is
+             not forbidden here and is policed by review instead. -->
+        <module name="MethodName">
+            <property name="format" value="^(?!find|query|fetch)[a-z][a-zA-Z0-9]*$"/>
+        </module>
         <module name="ParameterName"/>
         <module name="LocalVariableName"/>
         <module name="MemberName"/>
@@ -47,6 +52,15 @@
             <property name="allowMissingReturnTag" value="true"/>
             <property name="allowedAnnotations" value="Override"/>
         </module>
+        <!-- Dead imports and missing public API documentation. -->
+        <module name="UnusedImports"/>
+        <module name="MissingJavadocType">
+            <property name="scope" value="public"/>
+        </module>
+        <module name="MissingJavadocMethod">
+            <property name="scope" value="public"/>
+            <property name="allowedAnnotations" value="Override"/>
+        </module>
         <module name="NonEmptyAtclauseDescription"/>
         <module name="JavadocTagContinuationIndentation">
             <property name="offset" value="0"/>

pom.xml

@@ -984,6 +984,9 @@ ${dc3.copyright.body}
                     <artifactId>spotless-maven-plugin</artifactId>
                     <version>${spotless.version}</version>
                     <configuration>
+                        <!-- Only check files that changed relative to the baseline, so
+                             legacy formatting debt does not block unrelated work. -->
+                        <ratchetFrom>origin/main</ratchetFrom>
                         <java>
                             <palantirJavaFormat>
                                 <version>${palantir.java.format.version}</version>