feat(auth): JWT 密钥自动轮换调度器（#2067 发现3）

[DeliciousBuding]

Summary

Closes #2067 (发现3: KeyManager 支持多 kid 但无自动 rotation 调度器)

为 Hub Server 添加 JWT 签名密钥自动轮换能力：

• rotation.go: Rotator 核心逻辑（生成新 kid → SetActive → 旧 key 宽限期保留 → 到期 Remove），纯函数可注入时钟单测
• scheduler.go: 后台周期调度器，context 取消停止
• constants.go: DefaultJWTRotationInterval(24h) / DefaultJWTRotationGracePeriod(30m) + env var 覆盖
• metrics/jwt_rotation.go: jwt_rotations_total / jwt_rotation_failures_total / jwt_rotation_pending_keys（sync.Once 幂等注册）
• wiring.go: 一行接线 a.maybeStartJWTRotation(a.bg.Ctx())

Safety

• 默认关闭：需显式设置 AGENTHUB_JWT_ROTATION_ENABLED=true 才启动调度器
• 轮换失败保持旧 key 活跃，绝不空窗
• 宽限期 ≥ access_ttl(15m) + buffer，确保在途 token 不被踢
• 所有宽限期验签测试使用真实签发+真实 KeyManager.ParseToken，无 mock

BLOCKED (已知限制)

B1: 当前 auth middleware 仍走单-secret jwtutil.ParseToken 路径，未接 KeyManager。调度器启用后仅轮换 KeyManager 内部密钥，不影响现有验签。生产启用前需另 PR 将 middleware/service 切换到 KeyManager.ParseToken。详见 lane BLOCKED.md。

Test Evidence

任务 1: 宽限期验签红→绿

=== RUN   TestRotateOnce_OldKidVerifiesWithinGrace
--- PASS: TestRotateOnce_OldKidVerifiesWithinGrace (0.00s)
=== RUN   TestRotateOnce_OldKidRemovedAfterGrace
--- PASS: TestRotateOnce_OldKidRemovedAfterGrace (0.00s)
=== RUN   TestRotateOnce_FailurePreservesOldKey
--- PASS: TestRotateOnce_FailurePreservesOldKey (0.00s)

任务 3: 回归全绿

ok  github.com/agenthub/hub-server/internal/jwtutil    1.414s
ok  github.com/agenthub/hub-server/internal/middleware 34.699s
ok  github.com/agenthub/hub-server/internal/config     0.040s
ok  github.com/agenthub/hub-server/internal/app        1.749s

轮换中途验签不中断

=== RUN   TestRotationMidFlight_VerificationUninterrupted
--- PASS: TestRotationMidFlight_VerificationUninterrupted (0.00s)

Gates

• go vet: 0 issues
• golangci-lint: 0 issues
• hub go test ./... -short: ALL PASS
• verify-doc-ssot: ok

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9b2ebeb9-0f4d-4255-b12d-ec31fd9b0f33

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}