OIDC JWKS cache staleness alarm and forced refresh endpoint #686

Description

jwksCache refresh cadence is fixed and a stuck cache silently rejects freshly rotated IdP keys. Emit a gauge for cache age per issuer and expose an admin-only /auth/oidc/jwks/refresh endpoint to force reload during incidents.

Requirements and context

• Must be secure, tested, and documented
• Should be efficient and easy to review
• Relevant code: src/auth/oidc/jwksCache.ts
• Force-refresh must be rate-limited and audited

Suggested execution

• Fork the repo and create a branch
• git checkout -b feat/oidc-jwks-staleness-alarm
• Implement changes
  • Track per-issuer last-refresh
  • Add admin route with dual-control gate
  • Emit oidc.jwks.age_seconds gauge
• Validate security and correctness assumptions

Test and commit

• Run tests
  • npm test
• Cover edge cases
  • Concurrent force-refresh coalesces into single fetch
• Include test output and notes

Example commit message

feat: JWKS staleness alarm + force-refresh endpoint

Guidelines

• Minimum 95 percent test coverage
• Clear documentation
• Timeframe: 96 hours