[AZ-552] [AZ-553] [AZ-554] [AZ-555] Cycle-2 hotfix: deploy/infra chain

Batch 5 (cycle 2 hotfix sprint, batch 1 of 2). 6 story points under epic
AZ-530. Addresses 2 Critical + 2 High deploy-blocking findings from
security_report_cycle2.md (F-INFRA-1..F-INFRA-4).

AZ-552 — drop_jwt_secret_deploy_preflight (1 pt, F-INFRA-1 Critical)
  scripts/start-services.sh swaps obsolete JwtConfig__Secret preflight
  for the cycle-2 trio (KeysFolder + ActiveKid + DataProtection.KeysFolder).
  .env.example, env/api/env.ps1, _docs/04_deploy/* updated to match. Repo
  scan in scripts/ and .env.example returns 0 offenders.

AZ-553 — bind_mount_es256_keys (2 pts, F-INFRA-2 Critical)
  start-services.sh bind-mounts DEPLOY_HOST_JWT_KEYS_DIR read-only at
  /etc/azaion/jwt-keys; preflight fails fast on a missing or empty host
  directory with operator-actionable error messages.

AZ-554 — persist_dataprotection_keys (2 pts, F-INFRA-3 High)
  Program.cs DataProtection wiring now fails fast in Production when
  KeysFolder is unset OR not probe-writable. start-services.sh bind-mounts
  DEPLOY_HOST_DP_KEYS_DIR read-write at /var/lib/azaion/dp-keys.
  Development behaviour unchanged (ephemeral default).

AZ-555 — secrets_readme_es256_rewrite (1 pt, F-INFRA-4 High)
  secrets/README.md schema fully rewritten; new "Host-side directories"
  subsection with bind-mount table + ownership/permission guidance.
  Cycle-1 JwtConfig__Secret removed from live schema (one prose
  deprecation paragraph retained).

Adjacent hygiene
  module-layout.md "Owns" extended to include scripts/, secrets/, env/,
  .env.example (gap from Step 9 new-task layout-delta).

Tests
  e2e/Azaion.E2E/Tests/Cycle2HotfixDeployTests.cs — 19 facts (8 exec,
  11 Skip with rationale per AZ-537/AZ-538 precedent). Skipped tests
  cover preflight/restart/Production-only paths verified at deploy gate.

Build: 0W 0E across Azaion.AdminApi + Azaion.E2E.
Test run deferred to autodev Step 11 (Run Tests).
Tracker transition deferred to next batch (MCP availability unverified
in this session — Leftovers pattern).

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/02_tasks/_dependencies_table.md

@@ -1,8 +1,8 @@
 # Dependencies Table
 
-**Date**: 2026-05-14 (post cycle-2 security audit; previous 2026-05-14)
-**Total Tasks**: 25 (7 done test tasks + 4 done product tasks + 5 done cross-workspace + 3 done CMMC + 5 done auth-modernization + 6 todo cycle-2 hotfix)
-**Total Complexity Points**: 82 (71 done + 11 todo)
+**Date**: 2026-05-14 (post cycle-2 hotfix batch 1; previous 2026-05-14)
+**Total Tasks**: 25 (7 done test tasks + 4 done product tasks + 5 done cross-workspace + 3 done CMMC + 5 done auth-modernization + 4 done cycle-2 hotfix + 2 todo cycle-2 hotfix)
+**Total Complexity Points**: 82 (77 done + 5 todo)
 
 | Task   | Name                                | Complexity | Dependencies            | Epic   | Status |
 |--------|-------------------------------------|-----------:|-------------------------|--------|--------|
@@ -25,10 +25,10 @@
 | AZ-536 | argon2id_password_hashing           | 3          | None                    | AZ-530 | done   |
 | AZ-537 | login_rate_limit_lockout            | 3          | None (coord. AZ-536)    | AZ-530 | done   |
 | AZ-538 | cors_https_only_hsts                | 2          | None                    | AZ-530 | done   |
-| AZ-552 | drop_jwt_secret_deploy_preflight    | 1          | None                    | AZ-530 | todo   |
-| AZ-553 | bind_mount_es256_keys               | 2          | AZ-552                  | AZ-530 | todo   |
-| AZ-554 | persist_dataprotection_keys         | 2          | AZ-553                  | AZ-530 | todo   |
-| AZ-555 | secrets_readme_es256_rewrite        | 1          | AZ-552, AZ-553, AZ-554  | AZ-530 | todo   |
+| AZ-552 | drop_jwt_secret_deploy_preflight    | 1          | None                    | AZ-530 | done   |
+| AZ-553 | bind_mount_es256_keys               | 2          | AZ-552                  | AZ-530 | done   |
+| AZ-554 | persist_dataprotection_keys         | 2          | AZ-553                  | AZ-530 | done   |
+| AZ-555 | secrets_readme_es256_rewrite        | 1          | AZ-552, AZ-553, AZ-554  | AZ-530 | done   |
 | AZ-556 | unify_login_error_codes             | 2          | None                    | AZ-530 | todo   |
 | AZ-557 | mfa_brute_force_lockout             | 3          | AZ-534, AZ-537          | AZ-530 | todo   |