[AZ-576] Add e2e test infrastructure (xUnit + jwks-mock + reporting)

Scaffold the blackbox test project the rest of epic AZ-575 (AZ-577..AZ-586)
will build on. Two new csprojs under tests/, plus the TLS materials and
TRX->CSV reporting hand-off the existing docker-compose.test.yml already
calls for.

JWKS mock (tests/Azaion.Missions.JwksMock/):
- ASP.NET Core minimal API on .NET 10, no NuGet deps; JWS is hand-rolled
  to keep the surface tight and avoid version drift with the SUT
- KeyStore with one in-memory ECDSA P-256 keypair + retired-key grace
  window for NFT-RES-07 / NFT-SEC-11 rotation observability
- Endpoints: GET /.well-known/jwks.json, POST /sign, POST /rotate-key
- Mock-only alg_override / kid_override switches drive NFT-SEC-09/10/11
- TLS keypair committed under tls/; tests/jwks-mock-ca.crt is a copy
  mounted into both missions and e2e-consumer per docker-compose.test.yml

E2E consumer (tests/Azaion.Missions.E2E.Tests/):
- xUnit 2.9.2 + Bogus 35.6.1 + Npgsql 10.0.2 + Xunit.SkippableFact 1.4.13
- TestBase / TokenMinter scaffolding for downstream tasks
- Fixtures/ for DbReset, DbSeed, ComposeRestart, JwksRotate, JwksMockReverse
- Helpers/ for DbAssertions (side-channel), HttpAssertions, FixtureSql
- 8 Tests/<category>/Sanity.cs discovery smoke tests (AC-3)
- Tests/InfrastructureSanity.cs SkippableFacts for AC-1/2/5/6
- Tests/AaaPatternEnforcement.cs greps source files for AC-7
- Tests/Reporting/TrxToCsvPostProcessorTests.cs covers AC-4
- Reporting/TrxToCsvPostProcessor.cs handles VSTest TRX -> environment.md
  CSV; xUnit traits are not propagated by the TRX logger so the converter
  reflects them out of the test DLL via GetCustomAttributesData
- Reporting.Cli/ is a separate console csproj that links the converter
  source files (test project excludes Reporting.Cli/** from compile)
- Dockerfile + entrypoint.sh wire dotnet test -> trx -> csv inside the
  e2e-consumer container the compose file already references

Local verification: 13 pass, 3 skip (with explicit reasons), 0 fail.
End-to-end TRX->CSV manually verified against environment.md header spec.
Docker stack build is handed off to autodev Step 7 (test-run skill).

Reports under _docs/03_implementation/.
AZ-576 task spec moved to _docs/tasks/done/.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/Azaion.Missions.JwksMock/Services/KeyStore.cs

@@ -0,0 +1,118 @@
+using System.Security.Cryptography;
+
+namespace Azaion.Missions.JwksMock.Services;
+
+/// <summary>
+/// Holds the active ECDSA P-256 keypair used to sign test JWTs, plus an
+/// optional retired keypair retained for <c>OldKeyGraceSeconds</c> after a
+/// rotation so consumers can still validate in-flight tokens minted under the
+/// previous kid (NFT-RES-07 / NFT-SEC-11).
+/// </summary>
+/// <remarks>
+/// Singleton, thread-safe. The private key never leaves the container — only
+/// public-half exports go out via the JWKS endpoint.
+/// </remarks>
+public sealed class KeyStore : IDisposable
+{
+    private readonly TimeSpan _graceWindow;
+    private readonly TimeProvider _clock;
+    private readonly Lock _gate = new();
+
+    private KeypairEntry _active;
+    private KeypairEntry? _retired;
+
+    public KeyStore(TimeSpan graceWindow, TimeProvider clock)
+    {
+        _graceWindow = graceWindow;
+        _clock = clock;
+        _active = KeypairEntry.New();
+    }
+
+    public KeypairView Active
+    {
+        get
+        {
+            lock (_gate) return _active.View();
+        }
+    }
+
+    public IReadOnlyList<KeypairView> PublishedKeys()
+    {
+        lock (_gate)
+        {
+            EvictExpiredRetired();
+            if (_retired is null)
+                return [_active.View()];
+            return [_active.View(), _retired.View()];
+        }
+    }
+
+    /// <summary>
+    /// Rotate the active keypair. The previous active key is retained as the
+    /// retired key (overwriting any older retired entry) until
+    /// <c>OldKeyGraceSeconds</c> elapses.
+    /// </summary>
+    public KeypairView Rotate()
+    {
+        lock (_gate)
+        {
+            _retired?.Dispose();
+            _retired = _active.WithRetiredAt(_clock.GetUtcNow().Add(_graceWindow));
+            _active = KeypairEntry.New();
+            return _active.View();
+        }
+    }
+
+    public void Dispose()
+    {
+        lock (_gate)
+        {
+            _active.Dispose();
+            _retired?.Dispose();
+            _retired = null;
+        }
+    }
+
+    private void EvictExpiredRetired()
+    {
+        if (_retired is null) return;
+        if (_retired.RetiredAtUtc is { } retiredAt && _clock.GetUtcNow() > retiredAt)
+        {
+            _retired.Dispose();
+            _retired = null;
+        }
+    }
+
+    private sealed class KeypairEntry : IDisposable
+    {
+        public ECDsa Ec { get; }
+        public string Kid { get; }
+        public DateTimeOffset? RetiredAtUtc { get; }
+
+        private KeypairEntry(ECDsa ec, string kid, DateTimeOffset? retiredAt)
+        {
+            Ec = ec;
+            Kid = kid;
+            RetiredAtUtc = retiredAt;
+        }
+
+        public static KeypairEntry New()
+        {
+            var ec = ECDsa.Create(ECCurve.NamedCurves.nistP256);
+            // kid: SHA-256 of the public key parameters, base64url-truncated to 16 bytes.
+            var pub = ec.ExportSubjectPublicKeyInfo();
+            var hash = SHA256.HashData(pub);
+            var kid = Base64Url.Encode(hash.AsSpan(0, 16));
+            return new KeypairEntry(ec, kid, retiredAt: null);
+        }
+
+        public KeypairEntry WithRetiredAt(DateTimeOffset retiredAtUtc)
+            => new(Ec, Kid, retiredAtUtc);
+
+        public KeypairView View() => new(Kid, Ec, RetiredAtUtc);
+
+        public void Dispose() => Ec.Dispose();
+    }
+}
+
+public readonly record struct KeypairView(string Kid, ECDsa Ec, DateTimeOffset? RetiredAtUtc);