fix(platform): address round 2 review findings

src/main/java/com/lab/labtimesheet/config/TimeConfiguration.java

@@ -1,15 +1,18 @@
 package com.lab.labtimesheet.config;
 
 import java.time.Clock;
+import java.time.ZoneId;
 
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 
-/** Provides the injectable UTC clock used for server-authoritative business time. */
+/** Provides the injectable Vietnam-zone clock used for server-authoritative business dates and time. */
 @Configuration(proxyBeanMethods = false)
 class TimeConfiguration {
+    private static final ZoneId BUSINESS_ZONE = ZoneId.of("Asia/Ho_Chi_Minh");
+
     @Bean
     Clock applicationClock() {
-        return Clock.systemUTC();
+        return Clock.system(BUSINESS_ZONE);
     }
 }

src/main/java/com/lab/labtimesheet/feature/account/controller/AccountController.java

@@ -6,6 +6,7 @@ import com.lab.labtimesheet.feature.account.model.dto.ActivationForm;
 import com.lab.labtimesheet.feature.account.model.dto.CreateAccountForm;
 import com.lab.labtimesheet.feature.account.service.AccountService;
 import jakarta.validation.Valid;
+import org.hibernate.exception.ConstraintViolationException;
 import org.springframework.dao.DataIntegrityViolationException;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
@@ -14,7 +15,10 @@ import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.ModelAttribute;
 import org.springframework.web.bind.annotation.PostMapping;
 
-/** Handles Admin account creation and single-use account activation browser flows. */
+/**
+ * Handles Admin account creation and single-use account activation browser flows. Known database uniqueness
+ * constraints are mapped to their owning form fields without exposing persistence diagnostics.
+ */
 @Controller
 class AccountController {
     private final AccountService accounts;
@@ -43,7 +47,7 @@ class AccountController {
                     ? "redirect:/admin/accounts/new?created"
                     : "redirect:/admin/accounts/new?deliveryFailed";
         } catch (DataIntegrityViolationException duplicate) {
-            bindingResult.rejectValue("email", "account.email.duplicate", "An account with this email already exists");
+            rejectUniquenessViolation(bindingResult, duplicate);
             return "accounts/new";
         } catch (IllegalArgumentException | IllegalStateException exception) {
             bindingResult.reject("account.invalid", exception.getMessage());
@@ -76,4 +80,29 @@ class AccountController {
         form.clearPasswords();
         return "accounts/activate";
     }
+
+    private static void rejectUniquenessViolation(BindingResult bindingResult,
+            DataIntegrityViolationException violation) {
+        String constraintName = constraintName(violation);
+        if ("uq_app_users_email_ci".equals(constraintName)) {
+            bindingResult.rejectValue(
+                    "email", "account.email.duplicate", "An account with this email already exists");
+        } else if ("uq_intern_profiles_student_code_ci".equals(constraintName)) {
+            bindingResult.rejectValue("studentCode", "account.studentCode.duplicate",
+                    "An Intern with this student code already exists");
+        } else {
+            bindingResult.reject("account.unique", "Account details conflict with an existing account");
+        }
+    }
+
+    private static String constraintName(Throwable failure) {
+        Throwable current = failure;
+        while (current != null) {
+            if (current instanceof ConstraintViolationException violation) {
+                return violation.getConstraintName();
+            }
+            current = current.getCause();
+        }
+        return null;
+    }
 }

src/main/java/com/lab/labtimesheet/feature/integration/controller/SmtpController.java

@@ -19,11 +19,16 @@ import org.springframework.web.bind.annotation.RequestMapping;
 
 /**
  * Runs the Admin SMTP draft, connection-test, activation, and ordered setup-deferral browser workflows.
- * Cleartext passwords remain request-local and are cleared before any error view is rendered.
+ * Cleartext passwords remain request-local and are cleared before any error view is rendered. Failures crossing the
+ * SMTP adapter boundary are represented by fixed operator guidance rather than raw provider diagnostics.
  */
 @Controller
 @RequestMapping("/admin/smtp")
 class SmtpController {
+    private static final String TEST_FAILURE_MESSAGE =
+            "SMTP test failed. Verify the draft settings and server availability, then try again.";
+    private static final String ACTIVATION_FAILURE_MESSAGE =
+            "SMTP activation failed. Test the current draft again before activating it.";
     private static final String DEFERRAL_STEP = SmtpController.class.getName() + ".deferralStep";
     private static final List<String> DEFERRAL_WARNINGS = List.of(
             "Account onboarding is disabled until SMTP is active.",
@@ -72,7 +77,7 @@ class SmtpController {
             smtp.testDraft(action.getDraftId(), adminId(principal), principal.getName());
             return "redirect:/admin/smtp?tested";
         } catch (IllegalArgumentException | IllegalStateException failure) {
-            bindingResult.reject("smtp.test.failed", failure.getMessage());
+            bindingResult.reject("smtp.test.failed", TEST_FAILURE_MESSAGE);
             return renderActionError(model, bindingResult);
         }
     }
@@ -87,7 +92,7 @@ class SmtpController {
             smtp.activate(action.getDraftId(), adminId(principal));
             return "redirect:/admin/smtp?activated";
         } catch (IllegalArgumentException | IllegalStateException failure) {
-            bindingResult.reject("smtp.activate.failed", failure.getMessage());
+            bindingResult.reject("smtp.activate.failed", ACTIVATION_FAILURE_MESSAGE);
             return renderActionError(model, bindingResult);
         }
     }

src/main/resources/templates/accounts/new.html

@@ -26,6 +26,7 @@
     <fieldset>
       <legend>Intern details</legend>
       <label>Student code <input th:field="*{studentCode}" autocomplete="off"></label>
+      <p th:if="${#fields.hasErrors('studentCode')}" th:errors="*{studentCode}" role="alert"></p>
       <label>Internship start <input th:field="*{internshipStart}" type="date"></label>
       <label>Internship end <input th:field="*{internshipEnd}" type="date"></label>
     </fieldset>