fix(security): resolve Security-001/002/003 — reachable StartTLS path, Secure cookie, JWT signing key validation

src/ScadaLink.Security/JwtTokenService.cs

@@ -22,6 +22,19 @@ public class JwtTokenService
     {
         _options = options?.Value ?? throw new ArgumentNullException(nameof(options));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+
+        // Fail fast: a missing or short signing key produces trivially forgeable tokens.
+        // HMAC-SHA256 requires a key of at least 256 bits (32 bytes).
+        var keyByteLength = string.IsNullOrEmpty(_options.JwtSigningKey)
+            ? 0
+            : Encoding.UTF8.GetByteCount(_options.JwtSigningKey);
+        if (keyByteLength < SecurityOptions.MinJwtSigningKeyBytes)
+        {
+            throw new InvalidOperationException(
+                $"SecurityOptions.JwtSigningKey must be at least {SecurityOptions.MinJwtSigningKeyBytes} bytes " +
+                $"(256 bits) for HMAC-SHA256; the configured key is {keyByteLength} byte(s). " +
+                "Configure a strong signing key before starting the service.");
+        }
     }
 
     public string GenerateToken(