[Ezekiel146]

Closes #106

What changed

• backend/src/config/index.ts: JWT signing keyrings for access and refresh tokens. The current key is JWT_*_SECRET with an optional JWT_*_KID. An optional JWT_*_SECRET_PREVIOUS stays in the keyring during the overlap window.
• backend/src/modules/auth/services/tokens.ts: sign with the current key and write its kid into the token header. Verify with the key named by the header's kid. Tokens with an unknown kid are rejected. Tokens without a kid (issued before this change) are tried against each key.
• backend/tests/unit/tokens.test.ts: rotation tests. A new token records the current kid. A previous-key token verifies during the overlap window and fails after the key is removed. An unknown kid is rejected. A legacy token still verifies.
• docs/runbooks/secret-rotation.md: the rotation procedure and the env var table.
• changelog.d/106-jwt-key-rotation.md.

Which ROADMAP.md item does this close/progress?

Phase 9, issue #106 (production secrets management and key rotation). The rotation logic and the runbook are done. Still open: loading secrets from a secrets manager (depends on the platform choice in #22), the who-can-read-what section of the runbook, and the staging rotation record.

Docs updated in this PR

• ROADMAP.md: not edited, per the shared-docs rule. The maintainers update the status line.
• ARCHITECTURE.md
• ARCHITECTURE_ESSENTIALS.md
• PRD.md
• changelog.d/ entry and docs/runbooks/secret-rotation.md added

Validation

• Not run, per the requester's instruction to skip builds and tests for speed. Run npm run test in backend/ before merging.
• Diff scanned for token-like strings and private keys: none found.

🤖 Generated with Claude Code

[afeezorobsco-cyber]

@Ezekiel146 CI is failing on this branch against the latest main, so it can't be merged yet. The errors from the latest run:

Backend (typecheck + test + build)

src/modules/auth/services/tokens.ts(44,46): error TS2769: No overload matches this call.
tests/unit/tokens.test.ts(59,16): error TS2540: Cannot assign to 'accessKeys' because it is a read-only property.

tokens.ts:44 passes an options object that doesn't match any jwt.sign overload. On main, expiresIn is typed as the ms string type, so cast it or use the config's literal type. In tests/unit/tokens.test.ts:59, accessKeys is read-only, so stub it with vi.spyOn/vi.mock instead of assigning to it.

[github-actions]

@Ezekiel146 This PR now has merge conflicts with main, most likely because #152 (Feat/verified wallet links for patients and facilities) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-core.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[afeezorobsco-cyber]

@Ezekiel146 The only CI failure on your latest run is the Audit production dependencies step. That was caused by new axios/zod/body-parser advisories, not by your change, and it's fixed on main now (#249).

This PR also conflicts with main, so please rebase. That brings in the fix, and CI will rerun:

git fetch upstream
git rebase upstream/main
# fix the conflicts, then
git push --force-with-lease

[afeezorobsco-cyber]

Sweep: malware scan clean, CI green.

[afeezorobsco-cyber]

Sweep: malware scan clean, CI green.