[AZ-491] Cycle 3 batch 2: consolidate JWT test-mint helpers into TestSupport

AZ-491 (3 SP): eliminate the cycle-2 duplicate of JWT-minting logic
that existed in both SatelliteProvider.Tests/TestUtilities/
JwtTokenFactory.cs (unit-side) and SatelliteProvider.IntegrationTests/
JwtTestHelpers.cs (integration-side), where the same Expires <
NotBefore bug needed parallel fixes in commits f64d0d7 + 11b7074.

Option A chosen: new SatelliteProvider.TestSupport class library
(no test framework) holds the canonical JwtTokenFactory.Create /
CreateExpired / TamperSignature. Both Tests and IntegrationTests
consume it via ProjectReference; production projects (Api, Common,
DataAccess, Services.*) cannot depend on it. The notBefore-shift
workaround is preserved with an inline regression-prevention comment
back-referencing the cycle-2 fix commits.

SatelliteProvider.IntegrationTests/JwtTestHelpers.cs is stripped to
runner-only concerns: ResolveSecretOrThrow, AttachDefaultAuthorization,
and the DefaultSubject = "integration-tests" constant. Call sites in
Program.cs, JwtIntegrationTests.cs, and UavUploadTests.cs (10 sites)
switched to JwtTokenFactory.* with JwtTestHelpers.DefaultSubject
explicitly passed for the runner subject - behavior parity preserved.

Dockerfile for IntegrationTests gets the new TestSupport csproj
in its pre-restore COPY layer. Api Dockerfile unchanged (TestSupport
is NOT a production dependency).

A new code-review SKILL.md Phase 6 checklist row flags near-identical
helper logic across test projects as a Medium / Maintainability
finding with explicit cycle-2 retro back-reference, so this whole
pattern stops at one occurrence.

module-layout.md adds a TestSupport Shared/Cross-Cutting entry
documenting the production-isolation invariant. tests_unit.md +
tests_integration.md updated to describe the consolidated layout.
sln updated.

Test-suite gate (AC-2 + AC-3) deferred to Step 16 Final Test Run
per implement-skill convention. Per-batch review verdict:
PASS_WITH_WARNINGS with 1 Low (pre-existing 7.0.3 version pin
preserved verbatim from cycle-2 IntegrationTests csproj for parity;
not blocking; deferred bump).

Co-authored-by: Cursor <cursoragent@cursor.com>

SatelliteProvider.IntegrationTests/UavUploadTests.cs

@@ -4,6 +4,7 @@ using System.Net.Http.Json;
 using System.Security.Claims;
 using System.Text.Json;
 using Npgsql;
+using SatelliteProvider.TestSupport;
 using SixLabors.ImageSharp;
 using SixLabors.ImageSharp.Formats.Jpeg;
 using SixLabors.ImageSharp.PixelFormats;
@@ -49,7 +50,7 @@ public static class UavUploadTests
             }
         };
         using var client = CreateClient(apiUrl);
-        AttachToken(client, JwtTestHelpers.MintValidToken(secret, extraClaims: GpsClaim()));
+        AttachToken(client, JwtTokenFactory.Create(secret, JwtTestHelpers.DefaultSubject, extraClaims: GpsClaim()));
 
         // Act
         var response = await PostBatch(client, metadata, new[] { CreateValidJpeg() });
@@ -83,7 +84,7 @@ public static class UavUploadTests
             items = coords.Select(c => new { latitude = c.Latitude, longitude = c.Longitude, tileZoom = 18, tileSizeMeters = 200.0, capturedAt = DateTime.UtcNow.ToString("o") }).ToArray()
         };
         using var client = CreateClient(apiUrl);
-        AttachToken(client, JwtTestHelpers.MintValidToken(secret, extraClaims: GpsClaim()));
+        AttachToken(client, JwtTokenFactory.Create(secret, JwtTestHelpers.DefaultSubject, extraClaims: GpsClaim()));
 
         var good = CreateValidJpeg();
         var wrongDimensions = CreateValidJpeg(width: 512, height: 512);
@@ -149,7 +150,7 @@ public static class UavUploadTests
             }
         };
         using var client = CreateClient(apiUrl);
-        AttachToken(client, JwtTestHelpers.MintValidToken(secret, extraClaims: GpsClaim()));
+        AttachToken(client, JwtTokenFactory.Create(secret, JwtTestHelpers.DefaultSubject, extraClaims: GpsClaim()));
 
         // Act
         var response = await PostBatch(client, metadata, new[] { CreateValidJpeg() });
@@ -173,7 +174,7 @@ public static class UavUploadTests
         // Arrange
         var coord = NextTestCoordinate();
         using var client = CreateClient(apiUrl);
-        AttachToken(client, JwtTestHelpers.MintValidToken(secret, extraClaims: GpsClaim()));
+        AttachToken(client, JwtTokenFactory.Create(secret, JwtTestHelpers.DefaultSubject, extraClaims: GpsClaim()));
 
         var firstMetadata = new
         {
@@ -241,7 +242,7 @@ public static class UavUploadTests
 
         // Arrange
         using var client = CreateClient(apiUrl);
-        AttachToken(client, JwtTestHelpers.MintValidToken(secret, extraClaims: new[] { new Claim(PermissionsClaimType, "FL") }));
+        AttachToken(client, JwtTokenFactory.Create(secret, JwtTestHelpers.DefaultSubject, extraClaims: new[] { new Claim(PermissionsClaimType, "FL") }));
         var coord = NextTestCoordinate();
         var metadata = new
         {
@@ -283,7 +284,7 @@ public static class UavUploadTests
         var placeholder = new byte[] { 0xFF, 0xD8, 0xFF, 0xD9 };
         var files = Enumerable.Range(0, oversize).Select(_ => placeholder).ToArray();
         using var client = CreateClient(apiUrl);
-        AttachToken(client, JwtTestHelpers.MintValidToken(secret, extraClaims: GpsClaim()));
+        AttachToken(client, JwtTokenFactory.Create(secret, JwtTestHelpers.DefaultSubject, extraClaims: GpsClaim()));
 
         // Act
         var response = await PostBatch(client, metadata, files);