api: stamp kid/alg/use on Transit JWKS + Playwright e2e harness

[ExtraToast]

Summary

Two issues, related:

1. Bug — root cause of the post-#190 Vault sign-in failure.

After #190 fixed the JWKS 500, Vault sign-in then died with:

Provider.VerifyIDToken: invalid id_token: failed to verify signature:
failed to verify id token signature: invalid signature

Diagnosed by signing a known payload via transit/sign/api-jwt and verifying directly with the JWKS-published public key — the crypto is fine (RSA modulus matches, RS256 verifies, Vault's algorithm config is right). So the failure was upstream of the actual signature check.

The published JWK has no kid, no alg, no use — just {kty, e, n}. But VaultTransitJwtEncoder writes kid="api-jwt:v1" into the JWT header. Vault's verifier is coreos/go-oidc-v3, which filters JWKS keys by kid:

for _, key := range keys {
    if keyID == "" || key.KeyID == keyID {        // header.kid != JWK.KeyID=""
        if payload, err := jws.Verify(&key); err == nil { return payload, nil }
    }
}
return nil, errors.New("failed to verify id token signature")

Every key gets skipped → "invalid signature". Fix: rebuild each published JWK with kid="$keyName:v$version" matching the encoder, plus alg=RS256 and use=sig.

2. Test infra — Playwright OIDC e2e harness.

Vault dev container + transit init under the oidc-e2e compose profile; vaultOidcLiveTest gradle task running a Playwright system test that drives /oauth2/jwks against the live api over a real Vault. The test was the one that exposed the kid bug end-to-end — locally reproduced before fixing.

Includes one collateral fix the local repro forced: Dockerfile-dev pinned to eclipse-temurin:21-jdk-noble (the un-pinned 21-jdk resolves to ubuntu26.04, which Playwright 1.58 can't install browsers for on arm64).

Also tightens VaultTransitJwkSource to catch Throwable (was Exception): the bcpkix-missing failure that #190 fixes is a NoClassDefFoundError, an Error subclass — the narrow catch let it abort bean creation instead of degrading.

Verified locally

Diagnostic script (deleted from repo) confirmed: in prod, JWKS public key === Transit v1 public key (same RSA modulus sha256), signing-then-verify round-trips successfully — proving the failure is in JWK metadata, not crypto.

After the fix, /oauth2/jwks in the local stack now publishes:

{"kty":"RSA","e":"AQAB","use":"sig","kid":"api-jwt:v1","alg":"RS256","n":"..."}

./gradlew :services:api:test --tests VaultTransitJwkSourceTest    # 4/4
./gradlew :services:system-tests:vaultOidcLiveTest                 # SUCCESS

How to run locally

docker compose -f docker-compose.yml -f docker-compose.oidc-e2e.yml \
  --profile oidc-e2e up -d
curl http://localhost:8080/oauth2/jwks   # 200 with kid/alg/use
./gradlew :services:system-tests:vaultOidcLiveTest

Test plan

• Unit tests assert kid="api-jwt:v1", alg="RS256", use="sig" on the published JWK
• Playwright e2e asserts the same on /oauth2/jwks against the live api in compose
• Direct signing-and-verifying round-trip via cryptography lib confirms key + alg are correct end-to-end
• After merge + deploy: vault login -method=oidc role=… completes
• Headlamp OIDC sign-in completes