feat(l10-token-engine): v4.4.0 weekly run with multi-key payload normalization and JWT security hardening

[dcplatforms]

Executed the L10 Token Engine weekly Product Owner and Forward Engineer run (v4.4.0).

• Upgraded L10 Token Engine version to v4.4.0 in package.json, index.js (/health & /data/training/rewards), and PLATFORM_STATUS.md.
• Hardened extractSiteId(payload) in index.js with nested metadata fallback.
• Standardized DER_ALARM_REPORTED Kafka consumer to extract region across iso_region, isoRegion, iso, and region.
• Expanded Zero-Trust JWT authentication middleware to reject additional weak secrets (development_secret, change_in_production) in production.
• Updated security unit tests (38/38 passing), created verify_l10_v4_4_0.js verification script, and compiled WEEKLY_REPORT_SEPTEMBER_2026.md.

---

PR created automatically by Jules for task 6310138028251121571 started by @dcplatforms

---

Note

Medium Risk
Touches JWT production secret validation and Kafka-driven regional alarm keys that feed reward penalties. Mis-parsed regions or auth config could mis-apply health penalties or fail production auth.

Overview
Bumps Token Engine to v4.4.0 with tighter payload parsing and production JWT checks.

extractSiteId now walks nested metadata so site-aware rewards still apply when IDs are nested. The DER_ALARM_REPORTED consumer accepts iso_region, isoRegion, iso, or region so Redis hardware-health counters increment for mixed Kafka shapes.

authenticateToken rejects additional weak secrets (development_secret, change_in_production) when NODE_ENV is production. Version strings are updated on /health and the training export source field; tests and a source-string verify script cover the new checks.

^{Reviewed by Cursor Bugbot for commit 69bf63b. Configure here.}

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.