fix(deploy): align JAVA_HOME default to JDK 17 (match Dockerfile)

The Dockerfile installs openjdk-17-jre-headless and sets
JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64, but the entrypoint
default was still /usr/lib/jvm/java-11-openjdk-amd64. The
validation caught the mismatch at container start:

  [entrypoint] FATAL: JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64
  but /usr/lib/jvm/java-11-openjdk-amd64/bin/java is missing or
  not executable

That's exactly the failure mode the validation is designed to catch
- the deployment config got out of sync. Aligning all four files
(Dockerfile, entrypoint, .env.example, docker-compose.yml) to
java-17-openjdk-amd64.

No app code touched. 165/165 still pass.

.env.example

@@ -64,17 +64,17 @@ YARN_RESOURCE_MANAGER_URL=
 # SPARK_SUBMIT_OPTS=-Dhttps.proxyHost=proxy.corp -Dhttps.proxyPort=3128
 
 # --- Java + Spark install paths ---
-# Where the openjdk-11-jre-headless JDK lives, and where the Spark
+# Where the openjdk-17-jre-headless JDK lives, and where the Spark
 # distribution was extracted during the image build. Defaults match the
 # Dockerfile's ENTRYPOINT script. Override if you mount a different
-# Java (e.g. /usr/lib/jvm/java-17-openjdk-arm64 on some ARM hosts) or
-# a pre-installed Spark from a host volume (e.g. /opt/spark-3.1.2-bin-hadoop2.7).
+# Java (e.g. /usr/lib/jvm/java-21-openjdk-amd64 on hosts with Java 21)
+# or a pre-installed Spark from a host volume (e.g. /opt/spark-3.5.8-bin-hadoop3).
 #
 # The container's docker-entrypoint.sh re-derives PATH from these values
 # at every start, so overriding them here actually changes which `java`
 # and `spark-submit` binaries the gunicorn process picks up.
 #
-# JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64
+# JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
 # SPARK_HOME=/opt/spark
 
 # --- Gunicorn process model (see gunicorn.conf.py; NOT read by common/config.py) ---

docker-compose.yml

@@ -60,9 +60,9 @@ services:
       # Override to point at a different JDK install or pre-mounted Spark
       # distribution. The entrypoint re-derives PATH from these at every
       # container start, so overrides actually take effect.
-      # JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64
+      # JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
       # SPARK_HOME=/opt/spark
-      JAVA_HOME: ${JAVA_HOME:-/usr/lib/jvm/java-11-openjdk-amd64}
+      JAVA_HOME: ${JAVA_HOME:-/usr/lib/jvm/java-17-openjdk-amd64}
       SPARK_HOME: ${SPARK_HOME:-/opt/spark}
 
       # --- gunicorn.conf.py knobs (NOT read by common/config.py) ---

docker-entrypoint.sh

@@ -23,7 +23,8 @@
 set -e
 
 # Defaults match the Dockerfile's build-time ENV
-: "${JAVA_HOME:=/usr/lib/jvm/java-11-openjdk-amd64}"
+# (openjdk-17-jre-headless + Spark 3.5.8)
+: "${JAVA_HOME:=/usr/lib/jvm/java-17-openjdk-amd64}"
 : "${SPARK_HOME:=/opt/spark}"
 
 # --- Validation (fail fast with a clear error) ---