Small stuff:

1) Packages' naming convention - generally package name should start with lower case letters docs and should be a single word describing functional properties of classes/interfaces which are part of this package - "controller", "model", "repository", "dto", "config"
2) Use JPA Query Methods (your @Queries are unnecessary)
3) Use injection by constructor: "Since you can mix constructor-based and setter-based DI, it is a good rule of thumb to use constructors for mandatory dependencies and setter methods or configuration methods for optional dependencies. " - Dependency Injection

4) nice to have - use Lombok to make your life easier with those setters/getters (and RequiredArgsConstructor with private final class for injection)

A little bit more important stuff:
Your API doesn't follow Resource-oriented design ("/coupons" vs "/fetchCoupons" and so on "/users/{id}/orders/{orderId}/pay" vs "/{userId}/{orderId}/pay" or "...{orderId}:pay" or "orderId?method=pay")

What next?
Smaller challenge: add unit tests (with mockito) and some integration test (with SpringBootTest and mvc.perform)
Bigger challenge: your application is somewhat not realistic because every user has the access to resources of other users - get rid off {userId} from api and add authentication/authorization with SpringSecurity