[BUG] Blank heartbeat identity can overwrite an existing instance record #7764

Problem

InstanceController.beat uses @Valid, but InstanceBeatInfoDTO has no identity validation constraints. InstanceCheckService accepts a report with an empty IP. During persistence, selectOneByQuery omits the IP predicate for an empty value. createOrUpdate can then select an existing row by the remaining fields and overwrite its IP with the empty value.

This is input/data-integrity behavior, not a claim of authentication bypass. The observed path uses an otherwise valid namespace, port and instance type.

Verified reproduction

Baseline 66d7d954ca37d651a5ad916f988a8081157a7ab4, Java 17. Current DTO/checker/service/entity/VO/mapper were recompiled; the database probe used the current H2 table DDL and real MyBatis XML mapper.

1. Insert one valid repro / 127.0.0.1 / 9195 / bootstrap instance.
2. Build a report with the same namespace/port/type but IP "".
3. Actual Jakarta Bean Validation returns zero violations for that DTO.
4. Pass it through the real handleBeatInfo and syncDB methods.
5. Query the database: there is still one row, but its original valid IP has been overwritten with "".

All probe assertions passed. No HTTP request/controller deployment was executed, so MVC-level behavior still needs a regression test.

Evidence

• Controller validation boundary
• Protocol DTO without constraints
• Optional lookup predicates
• Lookup followed by unconditional field replacement

Acceptance criteria

• Reject incomplete/invalid identity before updating the live map or database; choose an Admin-boundary validation mechanism that respects protocol-module dependency boundaries.
• Persistence lookups that identify an existing instance require all canonical identity components and use exact predicates; do not reuse optional search semantics for an upsert identity.
• Controller tests reject empty/missing identity with a clear client error and no cache/mapper mutation.
• Service/mapper integration tests confirm malformed reports cannot modify an unrelated valid row, including whitespace and missing components.
• Cover internal WebSocket/HTTP/event report paths so they cannot bypass the shared identity invariant; retain explicit legacy protocol compatibility where required.
• Keep optional machine metadata separate from required instance identity and test namespace isolation.

Related: #7733 handles concurrent valid identities; #7696 fixes the type emitted by one producer; #6366 covers independent-client compatibility. None prevents a blank identity from broadening this lookup.