feat!(backend): move internal endpoints into internal controller service

[anna-parker]

partially resolves #855

Screenshot

PR Checklist

• All necessary documentation has been adapted.
• The implemented feature is covered by appropriate, automated tests.
• Any manual testing that has been done is documented (i.e. what exactly was tested?)

🚀 Preview: Add preview label to enable

[claude]

Claude finished @anna-parker's task in 2m 11s —— View job

---

Code Review

• Gather context and read changed files
• Review InternalController.kt (new file)
• Review SubmissionController.kt (modified)
• Review SubmissionDatabaseService.kt (modified)
• Post inline comments and summary

---

Good structural refactor overall — the endpoint split is clean and the existing tests should continue to cover the moved endpoints since the URL paths are unchanged.

Main issues (inline comments posted):

1. InternalController constructor has 5 unused dependencies (submitModel, backendConfig, objectMapper, groupManagementPreconditionValidator, dataUseTermsPreconditionValidator) — copied from SubmissionController but not used by any method in InternalController. These should be removed.

2. Unused log variable in InternalController — all methods delegate directly to the service with no controller-level logging.

3. Large number of unused imports in InternalController.kt — ./gradlew ktlintFormat will clean these up.

4. streamTransactioned placement (non-blocking) — moving it to SubmissionDatabaseService works but pulls HTTP streaming concerns (MDC, compression, StreamingResponseBody) into the persistence layer. Worth a follow-up to extract into a dedicated utility.

No security or correctness issues found. The access-control separation (the main goal of issue #855) is correctly deferred as a follow-up given the PR description says "partially resolves".