[AZ-487] JWT validation baseline (HS256, all endpoints)

Adds Microsoft.AspNetCore.Authentication.JwtBearer 8.0.21 and the
SatelliteProvider.Api.Authentication.AddSatelliteJwt extension that
validates HS256 tokens against a shared JWT_SECRET (>=32 bytes, fail
fast at startup). Every minimal-API endpoint now carries
.RequireAuthorization(); the middleware chain is UseExceptionHandler ->
UseHttpsRedirection -> UseCors -> UseAuthentication -> UseAuthorization
-> endpoints. Swagger UI gets a Bearer security definition so the
Authorize button works.

Test infrastructure: JwtTokenFactory (unit) and JwtTestHelpers
(integration) mint deterministic tokens against the same secret; the
integration test runner attaches a default Bearer token to its shared
HttpClient so existing tests continue to exercise protected endpoints.
JwtIntegrationTests adds AC-1..AC-4 and AC-7 (Swagger advertises
Bearer) end-to-end; AuthenticationServiceCollectionExtensionsTests
covers AC-5 (missing/empty/short secret fail-fast) plus env-var
precedence; JwtTokenFactoryTests covers AC-6 (claims pass through
the JwtSecurityTokenHandler.ValidateToken path JwtBearer uses).

docker-compose and scripts/run-tests.sh now propagate JWT_SECRET to
the api and integration-tests containers, with a >=32-byte guard.
.env.example documents the required keys; .env stays gitignored.

Code review verdict: PASS_WITH_WARNINGS (2 Low findings surfaced
in _docs/03_implementation/reviews/batch_01_cycle2_review.md).

Cross-component coordination: gps-denied-onboard and the mission
planner UI must attach Bearer tokens before this lands in dev.

Co-authored-by: Cursor <cursoragent@cursor.com>

SatelliteProvider.IntegrationTests/Program.cs

@@ -17,10 +17,23 @@ class Program
             TestRunMode.Smoke = modeEnv == "smoke";
         }
 
+        string jwtSecret;
+        try
+        {
+            jwtSecret = JwtTestHelpers.ResolveSecretOrThrow();
+        }
+        catch (InvalidOperationException ex)
+        {
+            Console.WriteLine("❌ Integration tests cannot start without a valid JWT secret.");
+            Console.WriteLine($"   {ex.Message}");
+            return 1;
+        }
+
         Console.WriteLine("Starting Integration Tests");
         Console.WriteLine("=========================");
         Console.WriteLine($"API URL : {apiUrl}");
         Console.WriteLine($"Mode    : {(TestRunMode.Smoke ? "smoke (fast subset, tightened timeouts)" : "full")}");
+        Console.WriteLine($"Auth    : JWT_SECRET resolved ({System.Text.Encoding.UTF8.GetByteCount(jwtSecret)} bytes)");
         Console.WriteLine();
 
         using var httpClient = new HttpClient
@@ -29,6 +42,9 @@ class Program
             Timeout = TimeSpan.FromMinutes(15)
         };
 
+        var defaultToken = JwtTestHelpers.MintValidToken(jwtSecret);
+        JwtTestHelpers.AttachDefaultAuthorization(httpClient, defaultToken);
+
         try
         {
             Console.WriteLine("Waiting for API to be ready...");
@@ -36,6 +52,8 @@ class Program
             Console.WriteLine("✓ API is ready");
             Console.WriteLine();
 
+            await JwtIntegrationTests.RunAll(apiUrl, jwtSecret);
+
             if (TestRunMode.Smoke)
             {
                 await RunSmokeSuite(httpClient);