[AZ-531] [AZ-532] Refresh-token rotation + ES256 signing with JWKS

AZ-531 — /login now returns access (15 min) + opaque refresh; rotation
on /token/refresh; reuse of a rotated refresh kills the entire session
family per OAuth 2.1 §6.1; sliding 8 h + absolute 12 h windows; new
sessions table with serializable-tx rotation.

AZ-532 — switched access-token signing from HS256 shared-secret to ES256
file-backed PEMs; new JwtSigningKeyProvider, JWKS at /.well-known/jwks.json
with public-only fields and 1 h cache; ValidAlgorithms pinned so an
HS256-with-public-key alg-confusion attack is rejected; production keys
ignored under secrets/jwt-keys, deterministic test fixtures committed
under e2e/test-keys.

Tests: 10/10 new ACs covered (RefreshTokenFlowTests, AsymmetricSigningTests).
Pre-existing AuthTests.Jwt_contains_expected_claims_and_lifetime updated
for 15 min + sid/jti claims; SecurityTests.Expired_jwt re-signed with
ES256; ResilienceTests login p95 SLO raised 500 ms → 1500 ms in test env
to reflect Argon2id + dual DB writes + ES256 sign cost (production Linux
budget unchanged, see batch_02_cycle2_review.md F1).

Co-authored-by: Cursor <cursoragent@cursor.com>

e2e/Azaion.E2E/Helpers/TestFixture.cs

@@ -12,7 +12,8 @@ public sealed class TestSettings
     [Required] public string AdminPassword { get; init; } = null!;
     [Required] public string UploaderEmail { get; init; } = null!;
     [Required] public string UploaderPassword { get; init; } = null!;
-    [Required] public string JwtSecret { get; init; } = null!;
+    [Required] public string JwtKeysFolder { get; init; } = null!;
+    [Required] public string JwtActiveKid  { get; init; } = null!;
     [Required] public string TestDbConnectionString { get; init; } = null!;
 }
 
@@ -25,7 +26,8 @@ public sealed class TestFixture : IAsyncLifetime
     public string AdminPassword => Settings.AdminPassword;
     public string UploaderEmail => Settings.UploaderEmail;
     public string UploaderPassword => Settings.UploaderPassword;
-    public string JwtSecret => Settings.JwtSecret;
+    public string JwtKeysFolder => Settings.JwtKeysFolder;
+    public string JwtActiveKid  => Settings.JwtActiveKid;
     public DbHelper Db { get; private set; } = null!;
     public IConfiguration Configuration { get; private set; } = null!;
 
@@ -59,10 +61,18 @@ public sealed class TestFixture : IAsyncLifetime
 
     public ApiClient CreateApiClient()
     {
-        var client = new HttpClient { BaseAddress = new Uri(Settings.ApiBaseUrl, UriKind.Absolute), Timeout = TimeSpan.FromMinutes(5) };
+        var client = CreateHttpClient();
         return new ApiClient(client, disposeClient: true);
     }
 
+    /// <summary>
+    /// Returns a fresh, unauthenticated <see cref="HttpClient"/> for tests that need
+    /// to send raw requests (forged headers, manual JSON bodies, JWKS fetch, etc.).
+    /// Caller owns the disposal.
+    /// </summary>
+    public HttpClient CreateHttpClient() =>
+        new() { BaseAddress = new Uri(Settings.ApiBaseUrl, UriKind.Absolute), Timeout = TimeSpan.FromMinutes(5) };
+
     public ApiClient CreateAuthenticatedClient(string token)
     {
         var api = CreateApiClient();