feat(portal-bff): signed-assertion strategy + /.well-known/jwks.json

Second half of the DownstreamApiClient + OBO chantier per ADR-0014.
Ships the signed-assertion strategy (non-Entra downstreams) and the
JWKS publishing endpoint as testable primitives. The framework
around them (DownstreamApiClientFactory, cockatiel, audience
pre-check, error translation) still waits for the first concrete
integration per the ADR's "until then" clause.

What lands

- assertJwksConfig (config/check-jwks-config.ts):
  - Reads the PEM private key once at boot, refuses missing /
    unreadable / weak material (RSA < 2048, Ed25519, unknown key
    type). Derives the JOSE algorithm (RS256 / ES256 / ES384) from
    the key shape so neither the strategy nor the JWKS controller
    has to re-decide on the hot path.
  - Validates BFF_JWKS_KID against [A-Za-z0-9_-]{4,128} so the
    value lives unescaped in JWT headers + JWKS payloads.
  - Wired in main.ts alongside the other assertX() validators.

- BffSigningKey (downstream/bff-signing-key.ts):
  - Singleton holding { config: JwksConfig, publicJwk: JWK }.
    publicJwk is derived from the private key via `jose.exportJWK`
    on a public KeyObject — no private material leaks through.
  - DI token BFF_SIGNING_KEY wires both consumers (strategy +
    controller) to the same source of truth.

- SignedAssertionStrategy (downstream/strategies/signed-assertion.strategy.ts):
  - Wraps `jose.SignJWT` with the ADR-0014 claim shape: iss,
    sub, aud, audience (workforce|customer), claims (curated
    subset), trace_id, iat, exp.
  - 60 s TTL hard-coded — the ADR mandates it; cache disabled
    because the savings on a 60 s JWT would be marginal and a
    cache would let replayed assertions linger past their TTL.
  - kid header matches the JWKS so a downstream picks the right
    key during rotation.
  - Supports RS256 / ES256 / ES384 transparently — picks the alg
    the validator derived at boot.

- JwksController (downstream/jwks.controller.ts):
  - GET /.well-known/jwks.json returns { keys: [<single jwk>] }.
  - main.ts excludes /.well-known/* from the global /api prefix so
    the route lands at the bare root per RFC 8615.
  - No auth gate (the JWKS is the verification anchor — gating it
    would defeat the purpose). Read-only, so the CSRF middleware's
    GET-exempt path already handles it.

Configuration

- Generate a key:
    mkdir -p apps/portal-bff/.secrets && \
    openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 \
      -out apps/portal-bff/.secrets/jwks.pem
- BFF_JWKS_PRIVATE_KEY_PATH (path to the PEM)
- BFF_JWKS_KID (URL-safe id, 4..128 chars)
- Both mandatory at boot.
- `apps/portal-bff/.secrets/` is matched by the repo's existing
  *.pem / *.key gitignore patterns.

Deps

- jose@^6 added as a direct dep (was transitive). Pinned at the
  workspace root since the BFF is the only consumer today and the
  package isn't part of the Angular bundle graph.
- jest.config.cts: jose ships ESM-only, so its node_modules path
  is removed from transformIgnorePatterns. The pattern walks
  pnpm's deep `.pnpm/` layout — anything under /node_modules/ that
  also contains `jose` somewhere in the path gets transformed.

Tests: +24 specs (env validators 11, signing key 4, strategy 6,
controller 3).

Out of scope (deferred per ADR-0014 "until then"):
- DownstreamApiClientFactory + per-service typed config.
- cockatiel resilience composition.
- Audience pre-check at the call site.
- Error translation tables.
- OTel custom spans `downstream.<service>.<verb>.<path>`.
- The framework wiring that calls SignedAssertionStrategy.sign()
  + attaches the `X-User-Assertion` + ServiceCredential auth
  header to outbound HTTP requests.
- Key rotation (the JWKS lists one key for now; rotation chantier
  adds a second entry + a window-based eviction policy).

These land alongside the first concrete integration so the
framework shape is validated against a real consumer.

apps/portal-bff/src/downstream/downstream.module.ts

@@ -1,44 +1,57 @@
 import { Module } from '@nestjs/common';
+import { assertJwksConfig } from '../config/check-jwks-config';
 import { assertOboCacheEncryptionKey } from '../config/check-obo-cache-encryption-key';
 import { AuthModule } from '../auth/auth.module';
 import { RedisModule } from '../redis/redis.module';
+import { BFF_SIGNING_KEY, buildBffSigningKey } from './bff-signing-key';
 import { DownstreamTokenCache } from './downstream-token-cache.service';
 import { OBO_CACHE_KEY } from './downstream.token';
+import { JwksController } from './jwks.controller';
 import { OboStrategy } from './strategies/obo.strategy';
+import { SignedAssertionStrategy } from './strategies/signed-assertion.strategy';
 
 /**
  * `DownstreamModule` — primitives for the downstream-API framework
  * per [ADR-0014](../../../../docs/decisions/0014-downstream-api-access-obo-pattern.md).
  *
- * **Scope (v1).** This module ships the auth-strategy primitives
- * and the OBO token cache only. The framework around them
- * (`DownstreamApiClientFactory`, cockatiel resilience stack,
- * audience pre-check, error translation table, OTel custom spans)
- * lands alongside the first concrete consumer per the ADR's own
- * guidance:
+ * **Scope (v1).** This module ships the auth-strategy primitives,
+ * the OBO token cache, and the BFF's JWKS publishing endpoint. The
+ * framework around them (`DownstreamApiClientFactory`, cockatiel
+ * resilience stack, audience pre-check, error translation, OTel
+ * custom spans) lands alongside the first concrete consumer per the
+ * ADR's own guidance:
  *
  *   "Mitigated by writing the framework code only in the same
  *    iteration as the first concrete integration; until then, this
  *    ADR plus mock-driven unit tests on the strategies (OBO,
  *    signed-assertion) keep the design honest."
  *
- * Until then `OboStrategy` is unused at runtime — exported here so
- * its unit tests can construct it through DI and the future
- * integration only has to import this module.
+ * What's exposed for the future integration to consume:
  *
- * Imports `AuthModule` to consume `MSAL_CLIENT`, `RedisModule` for
- * the shared `ioredis` client.
+ *   - `OboStrategy` (Entra-protected downstreams).
+ *   - `SignedAssertionStrategy` (non-Entra downstreams).
+ *   - `DownstreamTokenCache` (used internally by OboStrategy; exposed
+ *     in case a future consumer wants direct cache management).
+ *
+ * Imports `AuthModule` for the shared `MSAL_CLIENT`, `RedisModule`
+ * for the shared `ioredis` client.
  */
 @Module({
   imports: [AuthModule, RedisModule],
+  controllers: [JwksController],
   providers: [
     {
       provide: OBO_CACHE_KEY,
       useFactory: () => assertOboCacheEncryptionKey(),
     },
+    {
+      provide: BFF_SIGNING_KEY,
+      useFactory: () => buildBffSigningKey(assertJwksConfig()),
+    },
     DownstreamTokenCache,
     OboStrategy,
+    SignedAssertionStrategy,
   ],
-  exports: [OboStrategy, DownstreamTokenCache],
+  exports: [OboStrategy, SignedAssertionStrategy, DownstreamTokenCache],
 })
 export class DownstreamModule {}