[fjlopez]

Why

The seed counts in #312 do not lock the extra filter. public on territory 1 and internal on territory 1 return the same applications as the unfiltered list, and application 1 returns the same territories as the unfiltered list. Dropping the territory or application predicate still passed.

What changed

• internal has five applications. Territory 2 (Municipio B) returns the four role-1 titles and omits SITMUN - Externa protegida, for both the restricted query and the public-catalog query.
• internal has three territories. Application 5 returns only Provincia A, for both query variants.
• Client application lists keep the public page of four titles and the internal page of five. Territory 2 applications for internal are the four titles, with totalPages 4 when size=1.
• [Unreleased] ### Changed records the test lock for #312.

Scope

Tests and the changelog only. Production queries are unchanged. The existing filters already drop those rows; the assertions now require it.

Blast Radius

No API or schema change. public holds role 1 on every seed territory, so that user's page stays four titles on territory 2. The territory filter is locked by internal on territory 2 (4 versus 5). The application filter is locked by application 5 (Provincia A versus the three territories).

Verification

• ./gradlew spotlessApply and focused ApplicationRepositoryTest, TerritoryRepositoryTest, ClientConfigurationApplicationControllerTest, and ClientConfigurationTerritoryApplicationsControllerTest passed.
• Pre-commit ran spotlessCheck, the full test task, and jacocoTestReport. All passed. LDAP port 8389 was free.

Fixes #312