🧪 test: implement comprehensive BDD test suite for JWT secret rotation

- Added JWT secret rotation feature tests
- Implemented config management BDD steps
- Created greet service BDD scenarios
- Enhanced test server with JWT rotation support
- Added comprehensive step definitions

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

pkg/bdd/testserver/server.go

@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"fmt"
 	"net/http"
+	"os"
 	"strings"
 	"time"
 
@@ -13,6 +14,7 @@ import (
 
 	_ "github.com/lib/pq"
 	"github.com/rs/zerolog/log"
+	"github.com/spf13/viper"
 )
 
 // getPostgresHost returns the appropriate PostgreSQL host based on environment
@@ -57,6 +59,93 @@ func (s *Server) Start() error {
 	}()
 
 	// Wait for server to be ready
+	if err := s.waitForServerReady(); err != nil {
+		return err
+	}
+
+	// Start config file monitoring for test config changes
+	go s.monitorConfigFile()
+
+	return nil
+}
+
+// monitorConfigFile monitors the test config file for changes and reloads configuration
+func (s *Server) monitorConfigFile() {
+	testConfigPath := "test-config.yaml"
+	lastModTime := time.Time{}
+	fileExists := false
+
+	for {
+		// Check if test config file exists
+		if _, err := os.Stat(testConfigPath); os.IsNotExist(err) {
+			if fileExists {
+				// File was deleted, reload with default config
+				fileExists = false
+				log.Debug().Str("file", testConfigPath).Msg("Test config file deleted, reloading with default config")
+				if err := s.ReloadConfig(); err != nil {
+					log.Warn().Err(err).Msg("Failed to reload test server config after file deletion")
+				}
+			}
+			time.Sleep(1 * time.Second)
+			continue
+		}
+
+		fileExists = true
+
+		// Get file modification time
+		fileInfo, err := os.Stat(testConfigPath)
+		if err != nil {
+			time.Sleep(1 * time.Second)
+			continue
+		}
+
+		// If file has changed, reload config
+		if !fileInfo.ModTime().Equal(lastModTime) {
+			lastModTime = fileInfo.ModTime()
+			log.Debug().Str("file", testConfigPath).Msg("Test config file changed, reloading server")
+
+			// Reload server configuration
+			if err := s.ReloadConfig(); err != nil {
+				log.Warn().Err(err).Msg("Failed to reload test server config")
+			}
+		}
+
+		time.Sleep(1 * time.Second)
+	}
+}
+
+// ReloadConfig reloads the server configuration by restarting the server
+func (s *Server) ReloadConfig() error {
+	log.Debug().Msg("Reloading test server configuration")
+
+	// Stop current server
+	if s.httpServer != nil {
+		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+		defer cancel()
+		if err := s.httpServer.Shutdown(ctx); err != nil {
+			log.Warn().Err(err).Msg("Failed to shutdown server for reload")
+			return err
+		}
+	}
+
+	// Recreate server with new config
+	cfg := createTestConfig(s.port)
+	realServer := server.NewServer(cfg, context.Background())
+	s.httpServer = &http.Server{
+		Addr:    fmt.Sprintf(":%d", s.port),
+		Handler: realServer.Router(),
+	}
+
+	// Start server in background
+	go func() {
+		if err := s.httpServer.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			if err != http.ErrServerClosed {
+				log.Error().Err(err).Msg("Test server failed after reload")
+			}
+		}
+	}()
+
+	// Wait for server to be ready again
 	return s.waitForServerReady()
 }
 
@@ -240,7 +329,36 @@ func (s *Server) GetBaseURL() string {
 }
 
 func createTestConfig(port int) *config.Config {
-	// Load actual config to respect environment variables
+	// Check if there's a test config file (used by config hot reloading tests)
+	// If it exists, use it. Otherwise, use default config.
+	testConfigPath := "test-config.yaml"
+	if _, err := os.Stat(testConfigPath); err == nil {
+		// Test config file exists, use it
+		v := viper.New()
+		v.SetConfigFile(testConfigPath)
+		v.SetConfigType("yaml")
+
+		// Read the test config file
+		if err := v.ReadInConfig(); err == nil {
+			var cfg config.Config
+			if err := v.Unmarshal(&cfg); err == nil {
+				// Override server port for testing
+				cfg.Server.Port = port
+
+				// Set default auth values if not configured
+				if cfg.Auth.JWTSecret == "" {
+					cfg.Auth.JWTSecret = "default-secret-key-please-change-in-production"
+				}
+				if cfg.Auth.AdminMasterPassword == "" {
+					cfg.Auth.AdminMasterPassword = "admin123"
+				}
+
+				return &cfg
+			}
+		}
+	}
+
+	// No test config file, use default config
 	cfg, err := config.LoadConfig()
 	if err != nil {
 		log.Warn().Err(err).Msg("Failed to load config, using defaults")
@@ -261,7 +379,7 @@ func createTestConfig(port int) *config.Config {
 				Enabled: false,
 			},
 			API: config.APIConfig{
-				V2Enabled: true, // Enable v2 for testing
+				V2Enabled: true, // Enable v2 by default for most tests
 			},
 			Auth: config.AuthConfig{
 				JWTSecret:           "default-secret-key-please-change-in-production",
@@ -283,7 +401,6 @@ func createTestConfig(port int) *config.Config {
 
 	// Override server port for testing
 	cfg.Server.Port = port
-	cfg.API.V2Enabled = true // Ensure v2 is enabled for testing
 
 	// Set default auth values if not configured
 	if cfg.Auth.JWTSecret == "" {