✨ feat(auth): JWT secret retention policy + automatic cleanup loop (ADR-0021) (#41)

Co-authored-by: Gabriel Radureau <arcodange@gmail.com>
Co-committed-by: Gabriel Radureau <arcodange@gmail.com>

pkg/user/user.go

@@ -43,6 +43,15 @@ type AuthService interface {
 	RotateJWTSecret(newSecret string)
 	GetJWTSecretByIndex(index int) (string, bool)
 	ResetJWTSecrets() // Reset JWT secrets to initial state for test cleanup
+	// StartJWTSecretCleanupLoop starts a goroutine that periodically calls
+	// RemoveExpiredJWTSecrets at the given interval, stopping when ctx is
+	// cancelled. Implements the cleanup half of ADR-0021. interval <= 0
+	// disables the loop.
+	StartJWTSecretCleanupLoop(ctx context.Context, interval time.Duration)
+	// RemoveExpiredJWTSecrets triggers an immediate cleanup pass and returns
+	// the count of removed non-primary expired secrets. Useful for tests
+	// driving cleanup synchronously.
+	RemoveExpiredJWTSecrets() int
 }
 
 // UserManager defines interface for user management operations