Verify each finding against the current code and only fix it if needed.

Inline comments:
In
`@src/main/java/ku_rum/backend/domain/oauth/handler/OAuth2AuthenticationSuccessHandler.java`:
- Around line 60-67: In determineTargetUrl inside
OAuth2AuthenticationSuccessHandler, replace the RuntimeException thrown for an
unauthorized redirect URI (checked against REDIRECT_URI_PARAM_COOKIE_NAME) with
a 4xx-mapped exception (e.g., throw new AccessDeniedException("승인되지 않은 리다이렉션
URI입니다")) so the response is a client error (403) instead of 500; update imports
accordingly or alternatively create/throw a custom 4xx exception that your
global handler maps to the desired status.

In
`@src/main/java/ku_rum/backend/global/handler/GlobalExceptionControllerAdvice.java`:
- Around line 42-47: The current handleBadRequest in
GlobalExceptionControllerAdvice mixes NoHandlerFoundException and
TypeMismatchException returning HTTP 400 and URL_NOT_FOUND for both; split them
into two distinct handlers or branch inside handleBadRequest to return the
correct status/message: handle NoHandlerFoundException separately (use
`@ResponseStatus`(HttpStatus.NOT_FOUND) and return
BaseErrorResponse(URL_NOT_FOUND)) and handle TypeMismatchException with
`@ResponseStatus`(HttpStatus.BAD_REQUEST) returning the appropriate bad-request
error constant (e.g., BAD_REQUEST or INVALID_TYPE); update method
signatures/logging accordingly so each exception maps to the correct HTTP status
and error code.

In
`@src/test/java/ku_rum/backend/domain/common/mail/presentation/MailControllerTest.java`:
- Around line 110-112: Tests and documentation disagree on the type of the
"code" field: the test asserts jsonPath("$.code").value("200") (string) while
the API docs use
fieldWithPath("code").type(JsonFieldType.NUMBER).description(...). Make them
consistent by matching the actual response type: update the test assertion in
MailControllerTest to assert a numeric value (e.g.,
jsonPath("$.code").value(200)) if the API returns a number, or change the
documentation fieldWithPath("code") to JsonFieldType.STRING if the API returns a
string; locate the mismatch by looking for jsonPath("$.code").value("200") and
fieldWithPath("code").type(JsonFieldType.NUMBER") and update one side
accordingly.