fix: Address code review for /gates integration tests

Correct the misleading comment in postGateBodyWithBlockedReturns400 (it
claimed to exercise a null case but the body sent a string value).
Tighten the false-schema body assertion to pin the "keyword" field so
an unrelated property containing the substring "false" cannot satisfy it.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: thced

src/test/java/com/retailsvc/http/OpenApiServerIT.java

@@ -430,7 +430,7 @@ void postGateBodyWithOnlyOpenReturns200() {
     void postGateBodyWithBlockedReturns400() {
       try (var server = newServer(Map.of("post-gate", new EchoHandler()));
           var client = httpClient()) {
-        // Even null in 'blocked' triggers the false-schema rejection,
+        // Any value in 'blocked' triggers the false-schema rejection,
         // because NeverSchema rejects every value.
         var body = "{\"open\":\"x\",\"blocked\":\"anything\"}";
         var request = newRequest(server, path, "POST", ofString(body));
@@ -440,7 +440,7 @@ void postGateBodyWithBlockedReturns400() {
         assertThat(response.statusCode()).isEqualTo(400);
         assertThat(response.headers().firstValue("Content-Type").orElse(""))
             .contains("application/problem+json");
-        assertThat(response.body()).contains("false");
+        assertThat(response.body()).contains("\"keyword\":\"false\"");
       } catch (IOException e) {
         fail(e);
       } catch (InterruptedException e) {