✨ feat(admin): GET /api/v1/admin/jwt/secrets — metadata-only introspection (#51)

Co-authored-by: Gabriel Radureau <arcodange@gmail.com>
Co-committed-by: Gabriel Radureau <arcodange@gmail.com>

pkg/user/user.go

@@ -52,6 +52,24 @@ type AuthService interface {
 	// the count of removed non-primary expired secrets. Useful for tests
 	// driving cleanup synchronously.
 	RemoveExpiredJWTSecrets() int
+	// ListJWTSecretsInfo returns metadata about every currently-tracked JWT
+	// secret WITHOUT exposing the secret values. Used by the admin
+	// introspection endpoint and BDD tests verifying cleanup behavior.
+	// Order is preserved from internal storage (insertion order).
+	ListJWTSecretsInfo() []JWTSecretInfo
+}
+
+// JWTSecretInfo is a non-sensitive metadata view of a JWT secret.
+// The secret VALUE is intentionally NOT included — exposing it via an
+// API endpoint, even an admin one, would defeat the point of the
+// retention/rotation infrastructure.
+type JWTSecretInfo struct {
+	IsPrimary     bool   `json:"is_primary"`
+	CreatedAtUnix int64  `json:"created_at_unix"`
+	ExpiresAtUnix *int64 `json:"expires_at_unix,omitempty"`
+	AgeSeconds    int64  `json:"age_seconds"`
+	IsExpired     bool   `json:"is_expired"`
+	SecretSHA256  string `json:"secret_sha256"` // first 16 hex chars of sha256 — fingerprint, not the secret
 }
 
 // UserManager defines interface for user management operations