🧪 test: add BDD exclusion tags and mark JWT scenarios as todo

- Add @flaky, @todo, @skip tags to BDD_TAGS.md
- Modify all feature test suites to exclude these tags
- Update test scripts to exclude tagged scenarios
- Mark all JWT scenarios with pending steps as @todo

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

features/jwt/jwt_secret_retention.feature

@@ -10,6 +10,7 @@ Feature: JWT Secret Retention Policy
     And the retention factor is 2.0
     And the maximum retention is 72 hours
 
+  @todo
   Scenario: Automatic cleanup of expired secrets
     Given a primary JWT secret exists
     And I add a secondary JWT secret with 1 hour expiration
@@ -18,6 +19,7 @@ Feature: JWT Secret Retention Policy
     And the primary secret should remain active
     And I should see cleanup event in logs
 
+  @todo
   Scenario: Secret retention based on TTL factor
     Given the JWT TTL is set to 2 hours
     And the retention factor is 3.0
@@ -25,6 +27,7 @@ Feature: JWT Secret Retention Policy
     Then the secret should expire after 6 hours
     And the retention period should be 6 hours
 
+  @todo
   Scenario: Maximum retention period enforcement
     Given the JWT TTL is set to 72 hours
     And the retention factor is 3.0
@@ -33,6 +36,7 @@ Feature: JWT Secret Retention Policy
     Then the retention period should be capped at 72 hours
     And not exceed the maximum retention limit
 
+  @todo
   Scenario: Cleanup preserves primary secret
     Given a primary JWT secret exists
     And the primary secret is older than retention period
@@ -40,6 +44,7 @@ Feature: JWT Secret Retention Policy
     Then the primary secret should not be removed
     And the primary secret should remain active
 
+  @todo
   Scenario: Multiple secrets with different ages
     Given I have 3 JWT secrets of different ages
     And secret A is 1 hour old (within retention)
@@ -50,12 +55,14 @@ Feature: JWT Secret Retention Policy
     And secret B should be removed
     And secret C should be retained as primary
 
+  @todo
   Scenario: Cleanup frequency configuration
     Given the cleanup interval is set to 30 minutes
     When I add an expired JWT secret
     Then it should be removed within 30 minutes
     And I should see cleanup events every 30 minutes
 
+  @todo
   Scenario: Token validation with expired secret
     Given a user "retentionuser" exists with password "testpass123"
     And I authenticate with username "retentionuser" and password "testpass123"
@@ -65,6 +72,7 @@ Feature: JWT Secret Retention Policy
     Then the token validation should fail
     And I should receive "invalid_token" error
 
+  @todo
   Scenario: Graceful rotation during retention period
     Given a user "gracefuluser" exists with password "testpass123"
     And I authenticate with username "gracefuluser" and password "testpass123"
@@ -75,12 +83,14 @@ Feature: JWT Secret Retention Policy
     And the old token should still be valid during retention period
     And both tokens should work until retention period expires
 
+  @todo
   Scenario: Configuration validation
     Given I set retention factor to 0.5
     When I try to start the server
     Then I should receive configuration validation error
     And the error should mention "retention_factor must be ≥ 1.0"
 
+  @todo
   Scenario: Metrics for secret retention
     Given I have enabled Prometheus metrics
     When the cleanup job removes expired secrets
@@ -88,12 +98,14 @@ Feature: JWT Secret Retention Policy
     And I should see "jwt_secrets_active_count" metric decrease
     And I should see "jwt_secret_retention_duration_seconds" histogram update
 
+  @todo
   Scenario: Log masking for security
     Given I add a new JWT secret "super-secret-key-123456"
     When the cleanup job runs
     Then the logs should show masked secret "supe****123456"
     And not expose the full secret in logs
 
+  @todo
   Scenario: Cleanup with high volume of secrets
     Given I have 1000 JWT secrets
     And 300 of them are expired
@@ -102,12 +114,14 @@ Feature: JWT Secret Retention Policy
     And remove all 300 expired secrets
     And not impact server performance
 
+  @todo
   Scenario: Disabled cleanup via configuration
     Given I set cleanup interval to 8760 hours
     When I add expired JWT secrets
     Then they should not be automatically removed
     And manual cleanup should still be possible
 
+  @todo
   Scenario: Retention period calculation edge cases
     Given the JWT TTL is 1 hour
     And the retention factor is 1.0
@@ -115,12 +129,14 @@ Feature: JWT Secret Retention Policy
     Then the retention period should be 1 hour
     And the secret should expire after 1 hour
 
+  @todo
   Scenario: Secret validation with retention policy
     Given I try to add an invalid JWT secret
     When the secret is less than 16 characters
     Then I should receive validation error
     And the error should mention "must be at least 16 characters"
 
+  @todo
   Scenario: Cleanup job error handling
     Given the cleanup job encounters an error
     When it tries to remove a secret
@@ -128,6 +144,7 @@ Feature: JWT Secret Retention Policy
     And continue with remaining secrets
     And not crash the cleanup process
 
+  @todo
   Scenario: Configuration reload without restart
     Given the server is running with default retention settings
     When I update the retention factor via configuration
@@ -135,6 +152,7 @@ Feature: JWT Secret Retention Policy
     And existing secrets should be reevaluated
     And cleanup should use new retention periods
 
+  @todo
   Scenario: Audit trail for secret operations
     Given I enable audit logging
     When I add a new JWT secret
@@ -142,6 +160,7 @@ Feature: JWT Secret Retention Policy
     And when the secret is removed by cleanup
     Then I should see audit log entry with event type "secret_removed"
 
+  @todo
   Scenario: Retention policy with token refresh
     Given a user "refreshuser" exists with password "testpass123"
     And I authenticate and receive token A
@@ -150,6 +169,7 @@ Feature: JWT Secret Retention Policy
     And token A should still be valid until retention expires
     And both tokens should work concurrently
 
+  @todo
   Scenario: Emergency secret rotation
     Given a security incident requires immediate rotation
     When I rotate to a new primary secret
@@ -157,6 +177,7 @@ Feature: JWT Secret Retention Policy
     And new tokens should use the emergency secret
     And cleanup should remove compromised secrets
 
+  @todo
   Scenario: Monitoring and alerting
     Given I have monitoring configured
     When the cleanup job fails repeatedly

features/jwt/jwt_secret_rotation.feature

@@ -4,6 +4,7 @@ Feature: JWT Secret Rotation
   I want to rotate JWT secrets without disrupting users
   So that we can maintain security while ensuring continuous service
 
+  @todo
   Scenario: Authentication with multiple valid JWT secrets
     Given the server is running with multiple JWT secrets
     And a user "multiuser" exists with password "testpass123"
@@ -11,6 +12,7 @@ Feature: JWT Secret Rotation
     Then the authentication should be successful
     And I should receive a valid JWT token signed with the primary secret
 
+  @todo
   Scenario: Token validation with multiple valid secrets
     Given the server is running with multiple JWT secrets
     And a user "tokenuser" exists with password "testpass123"
@@ -21,6 +23,7 @@ Feature: JWT Secret Rotation
     Then the token should be valid
     And it should contain the correct user ID
 
+  @todo
   Scenario: Secret rotation - adding new secret while keeping old one valid
     Given the server is running with primary JWT secret
     And a user "rotateuser" exists with password "testpass123"
@@ -34,12 +37,14 @@ Feature: JWT Secret Rotation
     When I validate the old JWT token signed with primary secret
     Then the token should still be valid
 
+  @todo
   Scenario: Token rejection after secret expiration
     Given the server is running with primary and expired secondary JWT secrets
     When I use a JWT token signed with the expired secondary secret for authentication
     Then the authentication should fail
     And the response should contain error "invalid_token"
 
+  @todo
   Scenario: Graceful secret rotation with user continuity
     Given the server is running with primary JWT secret
     And a user "gracefuluser" exists with password "testpass123"

features/jwt/jwt_test.go

@@ -24,6 +24,7 @@ func TestJWTBDD(t *testing.T) {
 			Strict:        true,
 			Randomize:     -1,
 			StopOnFailure: true,
+			Tags:          "~@flaky && ~@todo && ~@skip",
 		},
 	}