docs(api): hide injected current user in OpenAPI

Annotate @CurrentUser with @Parameter(hidden = true) so the
server-injected user parameter no longer appears in the generated
API docs.

src/main/java/com/onixbyte/deltaforceguide/security/resolver/CurrentUser.java

@@ -1,5 +1,7 @@
 package com.onixbyte.deltaforceguide.security.resolver;
 
+import io.swagger.v3.oas.annotations.Parameter;
+
 import java.lang.annotation.ElementType;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
@@ -8,9 +10,13 @@ import java.lang.annotation.Target;
 /**
  * Annotation for injecting the currently authenticated {@code User} into controller method
  * parameters. The resolver extracts the user from the {@code SecurityContext}.
+ * <p>
+ * Marked hidden so it is not rendered as a request parameter in the OpenAPI documentation,
+ * as the value is injected server-side rather than supplied by the client.
  *
  * @author zihluwang
  */
+@Parameter(hidden = true)
 @Target(ElementType.PARAMETER)
 @Retention(RetentionPolicy.RUNTIME)
 public @interface CurrentUser {}