refactor(agent): lightweight JWT decoder — JWT_SECTRET first, AUTH_SECTRET_KEY fallback

Replaced src.core.auth.jwt.decode_token import with local _jwt_decoder.py:
  - Tries JWT_SECTRET first, falls back to AUTH_SECTRET_KEY (avoids key mismatch
    when both env vars are set in different test files)
  - verify_aud disabled — backend tokens have audience; agent ignores
  - No auth DB dependency — removed AUTH_DATABASE_URL requirement from agent

Cleanup:
  - Removed src/core/auth/ from agent Dockerfile COPY
  - Removed AUTH_SECTRET_KEY, AUTH_DATABASE_URL from agent compose env
  - conftest sets AUTH_SECTRET_KEY for test consistency
  - Updated test patches to new import path

Tests: 1176 passed, 0 failed

backend/tests/conftest.py

@@ -33,6 +33,7 @@ sys.path.insert(0, str(Path(__file__).parent.parent / "src"))
 import pytest
 
 os.environ.setdefault("SECRET_KEY", "test-secret-key-for-testing")
+os.environ.setdefault("AUTH_SECRET_KEY", "test-secret-key-for-jwt-testing")
 
 # ── Global engine: temp-file SQLite (not in-memory, not shared cache) ──
 # This prevents the 10GB memory leak from shared in-memory databases.
@@ -53,6 +54,7 @@ event.listen(engine, "connect", lambda c, _: c.execute("PRAGMA foreign_keys=ON")
 
 # ── Helper: FK-enabled SQLite engine for per-module isolation ──
 
+
 def make_fk_engine():
     """Create a per-module SQLite in-memory engine with FK enforcement.
 
@@ -66,6 +68,7 @@ def make_fk_engine():
 
 # ── CLI options ──
 
+
 def pytest_addoption(parser):
     parser.addoption(
         "--run-integration",
@@ -80,19 +83,23 @@ def pytest_addoption(parser):
 # GitService init, _ensure_base_path_exists calls mkdir('/app/storage/...')
 # which fails. Intercept silently for /app paths only.
 import pathlib as _pathlib
+
 _ORIG_MKDIR = _pathlib.Path.mkdir
 
+
 def _safe_mkdir(self, mode=0o777, parents=False, exist_ok=False):
     p = str(self)
     if p.startswith("/app"):
         return  # /app doesn't exist in test env — silently accept
     return _ORIG_MKDIR(self, mode, parents=parents, exist_ok=exist_ok)
 
+
 _pathlib.Path.mkdir = _safe_mkdir
 
 
 # ── Test session lifecycle ──
 
+
 def pytest_configure(config):
     print(
         f"\n[conftest] SQLite (global: {_TEST_DB_PATH}) + FK enforcement",
@@ -109,6 +116,7 @@ def pytest_unconfigure(config):
         from src.core.database import engine as _global_engine
         from src.core.database import tasks_engine as _tasks_engine
         from src.core.database import auth_engine as _auth_engine
+
         _global_engine.dispose()
         _tasks_engine.dispose()
         _auth_engine.dispose()
@@ -125,6 +133,7 @@ def ensure_db_tables():
     """Create all tables on the global database."""
     try:
         from src.core.database import init_db
+
         init_db()
     except Exception as exc:
         print(f"\n[conftest] init_db failed: {exc}", file=sys.stderr)
@@ -134,7 +143,7 @@ def ensure_db_tables():
 @pytest.fixture(scope="session", autouse=True)
 def ensure_git_storage_dirs(ensure_db_tables):
     """Patch StorageConfig default to a writable temp dir for tests.
-    
+
     The global pathlib.Path.mkdir monkey-patch (above) handles /app paths
     that don't exist in the test environment. This fixture only patches the
     Pydantic default so ConfigManager uses a temp path when no config.json exists.
@@ -142,14 +151,14 @@ def ensure_git_storage_dirs(ensure_db_tables):
     import os
     import tempfile
     from src.models.storage import StorageConfig
-    
+
     test_root = tempfile.mkdtemp(prefix="ss_tools_test_storage_")
     test_repos = os.path.join(test_root, "repositories")
     os.makedirs(test_repos, exist_ok=True)
-    
+
     StorageConfig.model_fields["root_path"].default = test_root
     StorageConfig.model_fields["repo_path"].default = "repositories"
-    
+
     print(f"\n[conftest] Storage root_path default={test_root}", file=sys.stderr)