feat(auth,app): ES256 JWT signing + AWS Secrets Manager key resolver

[jcsvwinston]

Summary

Implements the MVP scope the owner approved on 2026-05-14 — ES256 (P-256) JWT signing and an AWS Secrets Manager resolver for JWT key material. Designed and justified in ADR-005.

Lands on top of v0.7.0 (PR #57). Explicit non-goals, deferred to a follow-up: P-384/ES512/Ed25519, GCP Secret Manager, Azure Key Vault, HashiCorp Vault.

ES256 — pure stdlib, no new dependency

• pkg/auth: ES256 SigningAlgorithm + SigningKey.ECDSAPrivate. The validate / signingMethod / signMaterial / verifyMaterial / toJWK switches each gain an ES256 case. validate rejects any curve other than P-256 — a P-384 key with algorithm: ES256 fails fast at App.New. JWK gains Crv/X/Y; toJWK emits kty: EC, crv: P-256 with RFC 7518 §6.2 fixed-length (32-byte, left-padded) coordinates.
• pkg/app/jwt_setup.go: ES256 case in loadJWTKey; parseECDSAPrivateKey accepts SEC1 and PKCS#8, rejects non-P-256. Shared PEM plumbing factored out (loadPEMBytes, decodeSinglePEMBlock).

AWS Secrets Manager resolver

• New package pkg/auth/secrets: a Resolver interface, EnvResolver (zero-dependency — env:NAME and bare names), AWSSecretsManagerResolver (aws-sm:<id> and aws-sm:<id>#<json-key>), and a Chain that routes by scheme. The AWS SDK sits behind a one-method secretsManagerAPI interface; every constructor returns the framework's own Resolver interface — no AWS SDK type reaches a stable pkg/* signature.
• jwt_setup.go: secret_env / pem_env are now resolver references. A bare name or env:NAME reads the environment (unchanged behaviour); aws-sm:<id> reads AWS Secrets Manager. The AWS SDK client is built lazily — only when a jwt_keys[] entry uses the aws-sm: scheme — so non-AWS deployments never touch AWS credential resolution.
• buildJWTManager now takes a context.Context for lazy resolver construction.

Dependency

Adds github.com/aws/aws-sdk-go-v2/config and .../service/secretsmanager — the first cloud-vendor SDK in the tree, gated entirely to pkg/auth/secrets. dependency-impact review recorded at docs/reports/dependency_impact_aws_sdk_2026-05-14.md — verdict ACCEPT-WITH-NOTE: firewall clean, Apache-2.0, ~3-5 MB link delta, two cosmetic/Phase-4 follow-ups noted.

Test plan

• pkg/auth/jwt_es256_test.go — sign/validate roundtrip, JWKS EC key shape, P-256 enforcement (rejects P-384), coordinate left-padding invariant, alg-vs-kid mismatch rejection.
• pkg/auth/secrets/*_test.go — EnvResolver (bare + env: forms), AWSSecretsManagerResolver against a fake SDK client (plain secret, JSON-key fragment, missing secret, binary-secret rejection, SDK-error propagation), Chain scheme routing, compile-time proof the real *secretsmanager.Client satisfies the narrowed interface.
• pkg/app/jwt_setup_es256_test.go — ES256 PEM loading (SEC1 + PKCS#8), non-P-256 rejection, RSA-material rejection, JWKS auto-mount via ES256.
• resolver-chain wiring tests — env: prefix acceptance, lazy AWS construction (env-only keyset never builds the AWS resolver).
• go test ./... — clean.
• bash scripts/ci/check_contract_freeze.sh — PASS (ES256 additions are additive; firewall test confirms no AWS type leak).

Known follow-ups (from the dependency-impact review)

• Re-run go mod tidy once the pre-existing admin/proto replace-directive issue is unblocked, so the AWS modules carry correct // direct annotations.
• Phase 4: consider making the AWS SDK an opt-in link dependency (build tag / plugin) — pkg/app currently imports pkg/auth/secrets unconditionally.

🤖 Generated with Claude Code