api: stamp kid/alg/use on Transit JWKS so Vault's go-oidc picks the key

[ExtraToast]

Summary

Vault sign-in after #190 + #191 still failed:

Provider.VerifyIDToken: invalid id_token: failed to verify signature:
failed to verify id token signature: invalid signature

Diagnosed cryptographically against the live cluster: I signed a known payload via transit/sign/api-jwt, then verified it directly with both the JWKS-published public key and the Transit-engine PEM. Both verify cleanly. Same RSA modulus, RS256 with PKCS1v15+SHA256, signature length 256 — the crypto is correct end-to-end. So the failure was upstream of the actual signature check.

Root cause. The published JWK had no kid, no alg, no use — just {kty, e, n}. VaultTransitJwtEncoder writes kid="api-jwt:v1" into the JWT header. Vault's verifier is coreos/go-oidc-v3, which filters JWKS keys by kid:

for _, key := range keys {
    if keyID == "" || key.KeyID == keyID {        // header.kid="api-jwt:v1" != JWK.KeyID=""
        if payload, err := jws.Verify(&key); err == nil { return payload, nil }
    }
}
return nil, errors.New("failed to verify id token signature")

Every key skipped → error. Nimbus's RSAKey.parseFromPEMEncodedObjects leaves kid/alg/use unset, and VaultTransitJwkSource.refresh() published the parsed key as-is.

Fix

Three lines in VaultTransitJwkSource.refresh() — rebuild each parsed RSAKey with kid/alg/use stamped to match what the encoder writes:

RSAKey.Builder(parsed)
    .keyID("$keyName:v${vk.keyVersion}")
    .algorithm(JWSAlgorithm.RS256)
    .keyUse(KeyUse.SIGNATURE)
    .build()

Unit test now asserts kid="$keyName:v1", alg="RS256", use="sig" on the published JWK. System test (VaultTransitJwksPlaywrightTest) asserts the same on /oauth2/jwks against the live api in the oidc-e2e compose stack.

Verified locally

JWKS public key sha256(n)        = 37cfe9d8…
Transit api-jwt v1 sha256(n)     = 37cfe9d8…   ← identical
JWKS[0] verify of vault-signed:  ✓ VERIFIES
Transit v1 verify of vault-signed: ✓ VERIFIES

After fix, /oauth2/jwks returns:

{"kty":"RSA","e":"AQAB","use":"sig","kid":"api-jwt:v1","alg":"RS256","n":"..."}

Test plan

• ./gradlew :services:api:test --tests VaultTransitJwkSourceTest (4/4)
• ./gradlew :services:system-tests:vaultOidcLiveTest against compose stack — green
• After merge + deploy: vault login -method=oidc completes
• Headlamp OIDC completes