Backend: Implement signed JWT service tokens for internal services (replace shared API keys)

[greatest0fallt1me]

Description

Replace long-lived shared API keys with short-lived, signed JWT service tokens for internal service-to-service calls. Include key rotation, audience/issuer checks, and structured permission claims.

Requirements and context

• Must be secure, tested, and documented.
• Must support key rotation without downtime.
• Must include clear migration plan (support both for a window).

Suggested execution

git checkout -b feature/service-jwt-tokens

Implement changes

• Add JWT verification middleware for internal routes.
• Add token minting for service accounts (admin-only).
• Integration tests for token validity, expiry, and audience checks.
• Document in docs/security/service-auth.md.

Test and commit

npm test

Example commit message

feat(auth): service JWT tokens with rotation and migration plan

Guidelines

• Timeframe: 96 hours.