🧪 test: implement per-scenario state isolation and enhance validate-test-suite.sh

- Add pkg/bdd/steps/scenario_state.go with thread-safe per-scenario state manager
- Update auth_steps.go, jwt_retention_steps.go to use per-scenario state accessors
- Add LastSecret and LastError fields to ScenarioState for JWT retention testing
- Update steps.go with SetScenarioKeyForAllSteps function
- Update suite.go to generate scenario keys and clear state properly
- Mark config hot-reload scenarios as @flaky (timing-sensitive)
- Fix validate-test-suite.sh: add -p 1 flag for sequential execution, filter JSON logs, add --count flag
- Add CONFIG_SCHEMA.md documenting configuration architecture
- Split greet tests into v1/v2 sub-tests with explicit v2 enable/disable

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

pkg/bdd/steps/scenario_state.go

@@ -0,0 +1,100 @@
+package steps
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"sync"
+)
+
+// ScenarioState holds per-scenario state for step definitions
+// This prevents state pollution between scenarios running in the same test process
+type ScenarioState struct {
+	LastToken  string
+	FirstToken string
+	LastUserID uint
+	LastSecret string
+	LastError  string
+	// Add more fields as needed for other step types
+}
+
+// scenarioStateManager manages per-scenario state isolation
+type scenarioStateManager struct {
+	mu     sync.RWMutex
+	states map[string]*ScenarioState
+}
+
+var globalStateManager *scenarioStateManager
+var once sync.Once
+
+// GetScenarioStateManager returns the singleton scenario state manager
+func GetScenarioStateManager() *scenarioStateManager {
+	once.Do(func() {
+		globalStateManager = &scenarioStateManager{
+			states: make(map[string]*ScenarioState),
+		}
+	})
+	return globalStateManager
+}
+
+// scenarioKey generates a unique key for a scenario
+func scenarioKey(scenario string) string {
+	// Use SHA256 hash to create a consistent, bounded-length key
+	hash := sha256.Sum256([]byte(scenario))
+	return hex.EncodeToString(hash[:])
+}
+
+// GetState returns the state for a given scenario, creating it if necessary
+func (sm *scenarioStateManager) GetState(scenario string) *ScenarioState {
+	sm.mu.RLock()
+	key := scenarioKey(scenario)
+	state, exists := sm.states[key]
+	sm.mu.RUnlock()
+
+	if exists {
+		return state
+	}
+
+	sm.mu.Lock()
+	defer sm.mu.Unlock()
+
+	// Double-check after acquiring write lock
+	if state, exists = sm.states[key]; exists {
+		return state
+	}
+
+	state = &ScenarioState{}
+	sm.states[key] = state
+	return state
+}
+
+// ClearState removes the state for a given scenario
+func (sm *scenarioStateManager) ClearState(scenario string) {
+	sm.mu.Lock()
+	defer sm.mu.Unlock()
+	key := scenarioKey(scenario)
+	delete(sm.states, key)
+}
+
+// ClearAllStates removes all scenario states
+func (sm *scenarioStateManager) ClearAllStates() {
+	sm.mu.Lock()
+	defer sm.mu.Unlock()
+	sm.states = make(map[string]*ScenarioState)
+}
+
+// Package-level convenience functions
+
+// GetScenarioState returns the state for the current scenario
+func GetScenarioState(scenario string) *ScenarioState {
+	return GetScenarioStateManager().GetState(scenario)
+}
+
+// ClearScenarioState removes the state for the current scenario
+func ClearScenarioState(scenario string) {
+	GetScenarioStateManager().ClearState(scenario)
+}
+
+// ClearAllScenarioStates removes all scenario states
+func ClearAllScenarioStates() {
+	GetScenarioStateManager().ClearAllStates()
+}