[AZ-491] [AZ-492] [AZ-493] [AZ-494] [AZ-495] [AZ-496] Cycle 3 Step 9: 6 task specs

Drains the cycle-2 retrospective top-3 improvement actions plus three
carried-forward security and process items, into 6 individually-
trackable PBIs:

- AZ-491 (3 SP) consolidate JWT test-mint helpers (Retro Action 1)
- AZ-492 (3 SP) perf harness PT-07 + PT-08 + JWT-attach (Retro Act. 2)
- AZ-493 (2 SP) integration test DB-reset hook (Retro Action 3)
- AZ-494 (2 SP) JWT iss/aud validation (cycle-2 F-AUTH-2 Medium)
- AZ-495 (1 SP) doc-folder convention for WebApi (cycle 1+2 F1 carry)
- AZ-496 (2 SP) bump AspNetCore 8.0.21 -> 8.0.25 (cycle 1+2 D1+D3)

All 6 at-or-below the user-rule 5 SP cap. AZ-494 gated on admin-team
confirming iss/aud values. Cycle 3 total: 13 SP.

Autodev pointer advances to Step 10 Implement.

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/02_tasks/_dependencies_table.md

@@ -71,6 +71,19 @@ Roadmap: `_docs/04_refactoring/03-code-quality-refactoring/analysis/refactoring_
 | AZ-487 | JWT validation baseline (HS256, JWT_SECRET, all endpoints) | — (consumes suite-level contract `suite/_docs/10_auth.md`) | 2 | Done (In Testing) |
 | AZ-488 | UAV tile upload endpoint with batch + 5-rule quality gate | AZ-487 (hard prereq), AZ-484 contract `tile-storage.md` v1.0.0 | 8 (over-cap, user-accepted) | Done (In Testing) |
 
+### Step 9 cycle 3 — New Task: Cycle-2 follow-ups (test infra + security hardening + process)
+
+Source: cycle-2 retrospective top-3 improvement actions + carried-forward security and process items (`_docs/06_metrics/retro_2026-05-11_cycle2.md`).
+
+| Task | Title | Depends On | Points | Status |
+|------|-------|-----------|--------|--------|
+| AZ-491 | Consolidate JWT test-mint helpers | — (logically follows AZ-487 which introduced both copies) | 3 | To Do |
+| AZ-492 | Perf harness: PT-07 + PT-08 + JWT-attach in run-performance-tests.sh | AZ-487 (hard — Bearer token); AZ-491 (soft — token-mint reuse) | 3 | To Do |
+| AZ-493 | Integration test DB-reset hook | — | 2 | To Do |
+| AZ-494 | JWT iss/aud validation (enable + configure) | AZ-487 (extends `AddSatelliteJwt`); external: admin team confirms iss/aud values | 2 | To Do (blocked on cross-team input) |
+| AZ-495 | Resolve doc-folder convention for WebApi component | — | 1 | To Do |
+| AZ-496 | Bump Microsoft.AspNetCore.OpenApi + JwtBearer to 8.0.25 | — | 2 | To Do |
+
 ## Execution Order
 
 ### Step 6
@@ -97,6 +110,17 @@ Phase 4 (Typing/config/tooling/polish): AZ-371 → AZ-370 → AZ-373 → AZ-374
 1. AZ-487 — JWT validation baseline (must merge first; AZ-488 hard-depends on it)
 2. AZ-488 — UAV tile upload endpoint + 5-rule quality gate (consumer of both AZ-484 contract and AZ-487 auth)
 
+### Step 9 cycle 3
+
+Independent tracks — most tasks can run in parallel; the only ordering constraint is the AZ-491 → AZ-492 soft dependency for token-mint reuse.
+
+1. AZ-495 (1 SP) — doc-folder convention. Cheapest unblocker; lands first to stop the F1 recurrence.
+2. AZ-491 (3 SP) — consolidate JWT test-mint helpers. Pre-stages AZ-492 if implementer picks Option B.
+3. AZ-493 (2 SP) — integration test DB-reset hook. Independent.
+4. AZ-496 (2 SP) — bump AspNetCore 8.0.25. Independent.
+5. AZ-492 (3 SP) — perf harness. After AZ-491 if Option B; else any time.
+6. AZ-494 (2 SP) — JWT iss/aud validation. Gated on cross-team input; not blocked by other cycle-3 tasks.
+
 ## Total Effort
 
 Step 6: 6 tasks, 17 story points
@@ -104,6 +128,7 @@ Step 8 (02-coupling-refactoring): 6 tasks, 17 story points
 Step 8 (03-code-quality-refactoring): 27 tasks, ~66 story points
 Step 9 cycle 1: 1 task created (AZ-484, 5 pts)
 Step 9 cycle 2: 2 tasks created (AZ-487 = 2 pts, AZ-488 = 8 pts over-cap user-accepted) — total 10 pts
+Step 9 cycle 3: 6 tasks created (AZ-491 = 3 pts, AZ-492 = 3 pts, AZ-493 = 2 pts, AZ-494 = 2 pts, AZ-495 = 1 pt, AZ-496 = 2 pts) — total 13 pts
 
 ## Coverage Verification