Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@src/main/java/com/codeit/team5/mopl/content/controller/ContentController.java`:
- Around line 44-62: `patchContent`와 `deleteContent`가 ADMIN 전용이어야 하는데 현재는
`permitAll()` 설정 때문에 누구나 호출할 수 있습니다. `ContentController`의
`patchContent`/`deleteContent`에 메서드 보안을 적용하는
방식(`@PreAuthorize("hasRole('ADMIN')")`) 또는 `SecurityConfig`에서
`/api/contents/**`를 `hasRole("ADMIN")`으로 제한하는 방식으로 막고, 기존 `ContentController`와
`SecurityConfig` 설정이 OpenAPI의 `[어드민]` 표기와 일치하도록 정리해 주세요.

In `@src/main/java/com/codeit/team5/mopl/content/service/ContentService.java`:
- Around line 104-107: The variable name inside storeThumbnailImage currently
uses profileImage, which is misleading for thumbnail handling. Rename the local
variable in ContentService.storeThumbnailImage to thumbnail (and keep any
related uses aligned) so the identifier matches the method’s purpose and avoids
confusion with profile image logic.
- Around line 77-79: The tag update flow in ContentService currently clears all
tags and reattaches them, which can cause duplicate-key conflicts on the
content_tags composite PK and unnecessary DML. Update the tag handling in
ContentService.update by either computing the diff between existing and
requested tags and only removing/adding changes, or by forcing the deletes to be
flushed before attachTags runs if you keep the clear-and-reinsert approach. Use
the existing clearTags and attachTags methods as the main touchpoints.

In
`@src/main/java/com/codeit/team5/mopl/watcher/repository/WatchingSessionRepository.java`:
- Around line 24-25: The `WatchingSessionRepository.findByContentId(...)` query
is using an entity graph that includes the collection path `content.contentTags`
and `content.contentTags.tag`, which can distort `Window`/`ScrollPosition`
paging boundaries. Update the `@EntityGraph` on `findByContentId(...)` to keep
only the to-one associations (`user`, `content`, `content.thumbnail`,
`content.stats`) and remove the collection graph from this method. Load tags
separately, such as via a follow-up query or batch fetching, so the scrolling
window stays stable.

In `@src/test/java/com/codeit/team5/mopl/content/service/ContentServiceTest.java`:
- Around line 339-369: The update_allBlankTags_throwsException test should also
verify that no partial entity mutation occurs before validation fails. Add a
post-exception assertion on the Content created in the test to confirm its title
remains unchanged, so ContentService.update is forced to keep tag validation
before calling content.update and not leave a modified entity state on failure.
- Around line 312-337: `ContentService.update()` and `delete()` currently only
mark the old `BinaryContent` as `DELETED`, but they do not clean up the
underlying storage object, so the fix should separate the DB status change from
actual blob removal by introducing a storage-delete flow in
`BinaryContentStorage` or a delete event/listener. Update the
`update_withNewThumbnail_oldThumbnailMarkedDeleted`-style coverage to assert the
cleanup path as well as the status transition, and make sure
`ContentService.update()`, `ContentService.delete()`, and the thumbnail
replacement logic in `Content`/`BinaryContent` are wired to the new deletion
mechanism.

---

Outside diff comments:
In `@src/test/java/com/codeit/team5/mopl/user/service/UserServiceTest.java`:
- Around line 199-227: 현재 update_withImage_success()는 새 프로필 이미지만 붙는 경우만 검증해서, 기존
이미지가 있던 사용자의 교체 시 oldProfile이 DELETED로 전환되는 분기를 커버하지 못합니다. UserService.update와
관련된 프로필 이미지 교체 경로를 직접 검증하는 별도 테스트를 추가하거나 기존 테스트를 교체 시나리오로 바꿔서, User.create 대신 기존
profileImage를 가진 User를 준비한 뒤 oldProfile.getUploadStatus()가 DELETED로 바뀌는지 단언하세요.
ContentServiceTest의 동일한 교체 패턴을 참고해 UserServiceTest에서도 BinaryContent와
eventPublisher 흐름을 함께 확인하면 됩니다.