feat(batch9): implement f1 auth and dirstore foundations

dotnet/tests/ZB.MOM.NatsNet.Server.Tests/Accounts/DirectoryStoreTests.cs

@@ -767,4 +767,47 @@ public sealed class DirectoryStoreTests : IDisposable
             foreach (var s in stores) try { s?.Dispose(); } catch { /* best-effort */ }
         }
     }
+
+    [Fact]
+    public void ValidateDirPath_ExistingDirectory_ReturnsAbsolutePath()
+    {
+        var dir = MakeTempDir();
+
+        var validated = DirJwtStore.ValidateDirPath(dir);
+
+        validated.ShouldBe(Path.GetFullPath(dir));
+    }
+
+    [Fact]
+    public void ValidatePathExists_PathIsFileWhenDirectoryExpected_Throws()
+    {
+        var dir = MakeTempDir();
+        var file = Path.Combine(dir, "token.jwt");
+        File.WriteAllText(file, "jwt");
+
+        Should.Throw<InvalidOperationException>(() => DirJwtStore.ValidatePathExists(file, dir: true));
+    }
+
+    [Fact]
+    public void ExpirationTracker_HeapPrimitives_MaintainIndexAndTracking()
+    {
+        var tracker = new ExpirationTracker(limit: 10, evictOnLimit: true, ttl: TimeSpan.Zero);
+        var a = new JwtItem("A", expiration: 10, hash: [1, 2, 3]);
+        var b = new JwtItem("B", expiration: 20, hash: [4, 5, 6]);
+
+        tracker.Push(a);
+        tracker.Push(b);
+
+        tracker.Len().ShouldBe(2);
+        tracker.Less(0, 1).ShouldBeTrue();
+
+        tracker.Swap(0, 1);
+        tracker.Less(0, 1).ShouldBeFalse();
+
+        var popped = tracker.Pop();
+        popped.PublicKey.ShouldBe("A");
+        tracker.IsTracked("A").ShouldBeFalse();
+        tracker.IsTracked("B").ShouldBeTrue();
+        tracker.Len().ShouldBe(1);
+    }
 }