refactor: enhance JWT authentication and CORS configuration

Updated JWT authentication to use configuration values instead of hardcoded secrets, improving security and flexibility. Enhanced CORS policy to conditionally allow origins based on configuration settings, with logging for permissive defaults. Updated README to reflect project renaming and clarify service context.

_docs/tasks/done/AZ-540_missions_rename_b1_local_docs.md

@@ -0,0 +1,34 @@
+# [Missions rename B1] Rewrite local _docs/02_document/ for missions/vehicle
+
+**Task**: AZ-540_missions_rename_b1_local_docs
+**Name**: Rewrite local `flights/_docs/02_document/` for missions/vehicle terminology, drop GPS-Denied, clarify identity
+**Description**: Update every module / component / diagram / layout file under `flights/_docs/02_document/` to reflect the post-rename target (`Aircraft` -> `Vehicle`, `Flight` -> `Mission`, `VehicleType { Plane, Copter, UGV, GuidedMissile }`, GPS-Denied removed, identity model framed as suite-wide JWT). Each forward-looking file carries an explicit "NOTE (forward-looking)" header pointing at the relevant code-rename ticket so readers know the doc is the spec, not the current ground truth.
+**Complexity**: 3 points
+**Dependencies**: None (doc-only, doesn't depend on any other ticket)
+**Component**: `flights/_docs/02_document/` (modules, components, diagrams, layout, discovery)
+**Tracker**: AZ-540
+**Epic**: AZ-539
+**Status**: Done (2026-05-14)
+
+## Outcome (DONE)
+
+- 12 module docs rewritten under `flights/_docs/02_document/modules/`:
+  - `entities.md`, `dtos.md`, `enums.md`, `database.md`, `auth.md`, `middleware.md`, `program.md`, `service_waypoint.md` updated in place.
+  - `service_aircraft.md` deleted, `service_vehicle.md` created.
+  - `service_flight.md` deleted, `service_mission.md` created.
+  - `controller_aircrafts.md` deleted, `controller_vehicles.md` created.
+  - `controller_flights.md` deleted, `controller_missions.md` created.
+- 6 component docs under `flights/_docs/02_document/components/`:
+  - `01_aircraft_catalog/` directory deleted; `01_vehicle_catalog/` directory created with rewritten `description.md`.
+  - `02_mission_planning/description.md` rewritten (terminology + cascade shrink).
+  - `03_gps_denied/` directory deleted entirely.
+  - `04_persistence/description.md` rewritten (drops orthophotos + gps_corrections from owned tables).
+  - `05_identity/description.md` rewritten (drops `"GPS"` policy, adds suite-wide JWT subsection).
+  - `06_http_conventions/description.md` and `07_host/description.md` updated for terminology.
+- `module-layout.md`, `00_discovery.md`, and `diagrams/components.md` rewritten end-to-end.
+
+## Acceptance criteria (verified)
+
+- `rg -i 'aircraft|orthophoto|gps[-_.]?correction' flights/_docs/02_document/` returns ONLY hits inside deliberate "NOTE (forward-looking)" / divergence-table / Jira-link strings — verified post-edit.
+- Component count is 6 (was 7 with the gps_denied placeholder); `03_gps_denied/` directory does not exist; `01_vehicle_catalog/` directory exists.
+- Every component / module file says explicitly which Jira child ticket the rename / removal is tracked under.

_docs/tasks/done/AZ-542_missions_rename_b3_state_bookkeeping.md

@@ -0,0 +1,29 @@
+# [Missions rename B3] Update autodev state + create rename leftover entry
+
+**Task**: AZ-542_missions_rename_b3_state_bookkeeping
+**Name**: Update local autodev state + write `_process_leftovers/` rename-tracking entry
+**Description**: Record the doc-only rename and the pending code/DB/repo work in the local autodev state machine + the leftovers replay log so that the next `/autodev` invocation knows exactly where to resume and which child tickets remain.
+**Complexity**: 3 points
+**Dependencies**: B1 + B2 must land first so the state file can describe a coherent post-doc world
+**Component**: `flights/_docs/_autodev_state.md`, `flights/_docs/02_document/state.json`, `flights/_docs/_process_leftovers/`
+**Tracker**: AZ-542
+**Epic**: AZ-539
+**Status**: Done (2026-05-14)
+
+## Outcome (DONE)
+
+- `flights/_docs/_autodev_state.md` updated:
+  - `sub_step.phase: rename-paused`, `sub_step.name: missions-rename-doc-rewrite`, descriptive `detail` summarising A1+A2 done and where to resume after B-tickets.
+  - "Pending re-confirmation" + "Rename tracking" sections added so the resume path is explicit.
+- `flights/_docs/02_document/state.json` updated:
+  - `modules_documented` reflects new module names (`service_vehicle`, `service_mission`, `controller_vehicles`, `controller_missions`).
+  - `components_written` reflects the 6 surviving components (no `03_gps_denied` placeholder).
+  - `decomposition_revised[]` extended with a 2026-05-14 entry that records the user-requested refactor, the old/new component lists, the Jira Epic + child IDs, and the doc-only-vs-code-pending status.
+  - `rename_status: "doc-only; code/DB/HTTP/repo refactor pending B-tickets"` added.
+- `flights/_docs/_process_leftovers/2026-05-14_rename-flights-to-missions.md` created with the full Jira ticket table, status, replay obligation, and links back to the plan and to this Epic.
+
+## Acceptance criteria (verified)
+
+- The next `/autodev` resume reads `_autodev_state.md` and finds an explicit pause marker pointing at the Epic, not a half-completed doc step.
+- `_process_leftovers/` contains the rename entry and the file is dated 2026-05-14.
+- `state.json` is internally consistent: every entry in `components_written` corresponds to an existing directory under `_docs/02_document/components/`, and every entry in `modules_documented` corresponds to an existing file under `_docs/02_document/modules/`.