[AZ-576] Add e2e test infrastructure (xUnit + jwks-mock + reporting)

Scaffold the blackbox test project the rest of epic AZ-575 (AZ-577..AZ-586)
will build on. Two new csprojs under tests/, plus the TLS materials and
TRX->CSV reporting hand-off the existing docker-compose.test.yml already
calls for.

JWKS mock (tests/Azaion.Missions.JwksMock/):
- ASP.NET Core minimal API on .NET 10, no NuGet deps; JWS is hand-rolled
  to keep the surface tight and avoid version drift with the SUT
- KeyStore with one in-memory ECDSA P-256 keypair + retired-key grace
  window for NFT-RES-07 / NFT-SEC-11 rotation observability
- Endpoints: GET /.well-known/jwks.json, POST /sign, POST /rotate-key
- Mock-only alg_override / kid_override switches drive NFT-SEC-09/10/11
- TLS keypair committed under tls/; tests/jwks-mock-ca.crt is a copy
  mounted into both missions and e2e-consumer per docker-compose.test.yml

E2E consumer (tests/Azaion.Missions.E2E.Tests/):
- xUnit 2.9.2 + Bogus 35.6.1 + Npgsql 10.0.2 + Xunit.SkippableFact 1.4.13
- TestBase / TokenMinter scaffolding for downstream tasks
- Fixtures/ for DbReset, DbSeed, ComposeRestart, JwksRotate, JwksMockReverse
- Helpers/ for DbAssertions (side-channel), HttpAssertions, FixtureSql
- 8 Tests/<category>/Sanity.cs discovery smoke tests (AC-3)
- Tests/InfrastructureSanity.cs SkippableFacts for AC-1/2/5/6
- Tests/AaaPatternEnforcement.cs greps source files for AC-7
- Tests/Reporting/TrxToCsvPostProcessorTests.cs covers AC-4
- Reporting/TrxToCsvPostProcessor.cs handles VSTest TRX -> environment.md
  CSV; xUnit traits are not propagated by the TRX logger so the converter
  reflects them out of the test DLL via GetCustomAttributesData
- Reporting.Cli/ is a separate console csproj that links the converter
  source files (test project excludes Reporting.Cli/** from compile)
- Dockerfile + entrypoint.sh wire dotnet test -> trx -> csv inside the
  e2e-consumer container the compose file already references

Local verification: 13 pass, 3 skip (with explicit reasons), 0 fail.
End-to-end TRX->CSV manually verified against environment.md header spec.
Docker stack build is handed off to autodev Step 7 (test-run skill).

Reports under _docs/03_implementation/.
AZ-576 task spec moved to _docs/tasks/done/.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/Azaion.Missions.E2E.Tests/Fixtures/ComposeRestartFixture.cs

@@ -0,0 +1,50 @@
+using System.Diagnostics;
+
+namespace Azaion.Missions.E2E.Fixtures;
+
+/// <summary>
+/// Collection-scoped fixture for scenarios that assert startup-time behavior
+/// (migrator side-effects, JWKS bootstrap, env-var presence). Re-creates the
+/// compose stack between scenarios via <c>docker compose down -v &amp;&amp; up -d</c>.
+/// </summary>
+/// <remarks>
+/// The fixture only runs when <c>COMPOSE_RESTART_ENABLED=1</c> in the consumer
+/// container. CI sets this; per-developer runs leave it unset to keep the
+/// inner-loop fast. Tests that depend on the fixture must skip with a clear
+/// reason when it is disabled.
+/// </remarks>
+public sealed class ComposeRestartFixture
+{
+    public bool Enabled => Environment.GetEnvironmentVariable("COMPOSE_RESTART_ENABLED") == "1";
+
+    public string ComposeFile =>
+        Environment.GetEnvironmentVariable("COMPOSE_FILE_PATH") ?? "/workspace/docker-compose.test.yml";
+
+    public void RestartStack()
+    {
+        if (!Enabled)
+            throw new InvalidOperationException(
+                "ComposeRestartFixture is disabled; set COMPOSE_RESTART_ENABLED=1 to use it.");
+
+        Run("docker", $"compose -f {ComposeFile} down -v");
+        Run("docker", $"compose -f {ComposeFile} up -d postgres-test missions jwks-mock");
+    }
+
+    private static void Run(string file, string args)
+    {
+        var psi = new ProcessStartInfo(file, args)
+        {
+            RedirectStandardOutput = true,
+            RedirectStandardError = true,
+            UseShellExecute = false
+        };
+        using var p = Process.Start(psi)
+            ?? throw new InvalidOperationException($"Failed to launch {file} {args}");
+        p.WaitForExit();
+        if (p.ExitCode != 0)
+        {
+            var err = p.StandardError.ReadToEnd();
+            throw new InvalidOperationException($"`{file} {args}` exited {p.ExitCode}: {err}");
+        }
+    }
+}

tests/Azaion.Missions.E2E.Tests/Fixtures/DbResetFixture.cs

@@ -0,0 +1,44 @@
+using Npgsql;
+
+namespace Azaion.Missions.E2E.Fixtures;
+
+/// <summary>
+/// Class-scoped DB reset (xUnit <see cref="IClassFixture{TFixture}"/>).
+/// Truncates all schema tables between test classes so read-path scenarios
+/// (AC-1, AC-2, AC-4) start from a known state.
+/// </summary>
+/// <remarks>
+/// CASCADE is used so FK chains (mission → waypoint, mission → media) flush
+/// in one round-trip. Sequence resets are explicit because TRUNCATE alone
+/// does not reset SERIAL/BIGSERIAL counters when RESTART IDENTITY is omitted.
+/// </remarks>
+public sealed class DbResetFixture : IDisposable
+{
+    public DbResetFixture()
+    {
+        ResetDatabase(TestEnvironment.DbSideChannel);
+    }
+
+    public void Dispose() { /* No-op — TRUNCATE is the only state owned. */ }
+
+    public static void ResetDatabase(string connectionString)
+    {
+        using var conn = new NpgsqlConnection(connectionString);
+        conn.Open();
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = """
+            DO $$
+            DECLARE
+                t TEXT;
+            BEGIN
+                FOR t IN
+                    SELECT tablename FROM pg_tables
+                    WHERE schemaname = 'public' AND tablename NOT LIKE 'pg_%'
+                LOOP
+                    EXECUTE format('TRUNCATE TABLE %I RESTART IDENTITY CASCADE', t);
+                END LOOP;
+            END $$;
+            """;
+        cmd.ExecuteNonQuery();
+    }
+}

tests/Azaion.Missions.E2E.Tests/Fixtures/DbSeedFixture.cs

@@ -0,0 +1,34 @@
+using Npgsql;
+
+namespace Azaion.Missions.E2E.Fixtures;
+
+/// <summary>
+/// Generic seed-applying fixture. Concrete child tasks (AZ-577 onward) supply
+/// a <typeparamref name="TSeed"/> that exposes the inline SQL or named SQL
+/// file from <c>_docs/02_document/tests/test-data.md § Seed Data Sets</c>.
+/// </summary>
+public abstract class DbSeedFixture<TSeed> : IDisposable where TSeed : ISeedSpec, new()
+{
+    public DbSeedFixture()
+    {
+        DbResetFixture.ResetDatabase(TestEnvironment.DbSideChannel);
+        Apply(new TSeed());
+    }
+
+    public void Dispose() { /* Cleanup handled by next fixture's reset. */ }
+
+    private static void Apply(ISeedSpec seed)
+    {
+        using var conn = new NpgsqlConnection(TestEnvironment.DbSideChannel);
+        conn.Open();
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = seed.Sql;
+        cmd.ExecuteNonQuery();
+    }
+}
+
+public interface ISeedSpec
+{
+    string Name { get; }
+    string Sql { get; }
+}

tests/Azaion.Missions.E2E.Tests/Fixtures/JwksMockReverseFixture.cs

@@ -0,0 +1,19 @@
+namespace Azaion.Missions.E2E.Fixtures;
+
+/// <summary>
+/// Spec-only fixture for NFT-SEC-13 (E9 Production-environment CORS lock).
+/// Runs <c>missions</c> outside compose via <c>docker run</c> with
+/// <c>ASPNETCORE_ENVIRONMENT=Production</c> and an empty
+/// <c>CorsConfig:AllowedOrigins</c> to assert startup THROWS. Concrete
+/// implementation lands in AZ-582 (security: alg, rotation, CORS).
+/// </summary>
+/// <remarks>
+/// Lives in <c>Fixtures/</c> so the placeholder is visible from test
+/// discovery: tests that need the reverse-fixture should depend on this
+/// type and skip with <c>Skip="missions Production-mode harness pending"</c>
+/// until AZ-582 lands.
+/// </remarks>
+public sealed class JwksMockReverseFixture
+{
+    public bool Implemented => false;
+}

tests/Azaion.Missions.E2E.Tests/Fixtures/JwksRotateFixture.cs

@@ -0,0 +1,41 @@
+using System.Net.Http.Json;
+using System.Text.Json.Serialization;
+
+namespace Azaion.Missions.E2E.Fixtures;
+
+/// <summary>
+/// Triggers <c>POST {jwks-mock}/rotate-key</c> and waits up to
+/// <c>RotationTimeout</c> for the missions service to refresh its JWKS cache,
+/// observable via successful authentication with the new <c>kid</c>.
+/// </summary>
+public sealed class JwksRotateFixture
+{
+    public TimeSpan RotationTimeout { get; init; } = TimeSpan.FromSeconds(45);
+
+    public async Task<RotationResult> RotateAndWaitAsync(
+        Func<Task<bool>> isNewKeyAccepted,
+        CancellationToken ct = default)
+    {
+        var rotateUrl = new Uri(new Uri(TestEnvironment.JwksMockBaseUrl), "/rotate-key");
+        using var http = new HttpClient { Timeout = TimeSpan.FromSeconds(10) };
+        using var resp = await http.PostAsync(rotateUrl, content: null, ct).ConfigureAwait(false);
+        resp.EnsureSuccessStatusCode();
+        var rotated = await resp.Content.ReadFromJsonAsync<RotateResponse>(cancellationToken: ct).ConfigureAwait(false);
+        if (rotated is null)
+            throw new InvalidOperationException("jwks-mock /rotate-key returned an empty body");
+
+        var deadline = DateTime.UtcNow + RotationTimeout;
+        while (DateTime.UtcNow < deadline)
+        {
+            if (await isNewKeyAccepted().ConfigureAwait(false))
+                return new RotationResult(rotated.Kid, Accepted: true);
+            await Task.Delay(TimeSpan.FromMilliseconds(500), ct).ConfigureAwait(false);
+        }
+        return new RotationResult(rotated.Kid, Accepted: false);
+    }
+
+    public sealed record RotationResult(string NewKid, bool Accepted);
+
+    private sealed record RotateResponse(
+        [property: JsonPropertyName("kid")] string Kid);
+}