test(auth): add unit test coverage for JWT issuance, decoding and AuthUser extractor (#43)

[ghzhost]

Summary of Changes

Adds comprehensive unit test coverage for src/middleware/auth.rs covering JWT issuance, validation/decoding, algorithm enforcement, expiry behavior, signature verification, and request extractor edge cases, addressing #43.

Tests Added

1. round_trip_issue_and_decode_recovers_claims:
   • Verifies issue_jwt followed by decode_jwt successfully recovers original sub (user UUID), email, and correct timestamp claims (exp - iat == 24h).
2. decode_fails_with_invalid_token_when_secret_mismatches:
   • Confirms decoding with an incorrect secret key returns AppError::InvalidToken.
3. decode_specifically_fails_with_token_expired_when_past_exp:
   • Tests that an expired token (expiry_hours: -1) maps specifically to AppError::TokenExpired, verifying the distinction from InvalidToken.
4. decode_fails_when_signature_is_tampered:
   • Verifies that tampering with the token signature payload fails validation as AppError::InvalidToken.
5. decode_fails_when_algorithm_is_different:
   • Verifies algorithm pinning: tokens signed with algorithms other than HS256 (such as HS384) are rejected as AppError::InvalidToken.
6. extractor_rejects_missing_authorization_header:
   • Tests AuthUser::from_request_parts returns AppError::Unauthorized when the Authorization header is missing.
7. extractor_rejects_malformed_auth_scheme:
   • Tests AuthUser::from_request_parts returns AppError::Unauthorized for non-Bearer schemes (e.g. Basic ...).
8. extractor_rejects_non_uuid_sub:
   • Tests AuthUser::from_request_parts rejects tokens where sub is not a valid UUID with AppError::InvalidToken.
9. extractor_succeeds_with_valid_bearer_token:
   • Tests happy-path extraction into AuthUser struct with populated user_id, email, and claims.

Fixes #43