JWK key-ring loader hardening

[valentina2509]

JWK key-ring loader hardening

This is a tracking issue for defects in the JWK key-ring loader at
lore-server/src/auth/jwk.rs. All four items share the same source file and
interact in ways that make merge sequencing important.

Child issues and related items

Item	Locus	Status	Priority
(untracked) Cache short-circuit — key rotation broken	jwk.rs:89	No PR — file and land first	Highest
PR #49 — JWT auth bypass (empty permission lists)	lore-server auth helpers + handlers	PR #49 is the fix	Second
#60 — Opaque Internal Error on missing alg/kid	jwk.rs:141,146	PR #65 open	Third
#32 — file:// scheme rejected	jwk.rs (fetch_new_keys)	PR #44 open	Independent

Defect detail — cache short-circuit (highest priority, no open PR)

lore-server/src/auth/jwk.rs:89:

if desired.map(|d| cache.get(d)).is_some() {
    return Ok(());
}

Option::map on a Some(x) always returns Some(…), so .is_some() is
invariantly true whenever desired is Some(_). The intended check was
whether the cache entry for the desired key exists. The actual effect is
that every look-up short-circuits the cache refresh, making key rotation
impossible after startup: any key added to or rotated in the upstream JWKS
will never be picked up until the server restarts.

One-line fix:

if desired.and_then(|d| cache.get(d)).is_some() {

This is a security-significant bug and should be filed and merged before any
other auth changes to bound the risk of adjacent-path regressions.

Merge sequencing recommendation

1. File and merge the jwk.rs:89 one-line cache fix as a standalone PR.
2. Merge PR lore-server: Support file:// JWKS endpoints in JWK service  #44 (file:// scheme) — low-risk, independent.
3. Review PR fix(auth): infer RS256 from RSA+sig when JWK alg is missing #65 and PR lore-server: Enforce repository write permissions #49 together; both touch authentication paths.

Background

Identified in the open-bug theme analysis (triage/2026-06-bug-theme-analysis.md,
branch valentina2509:docs/bug-theme-analysis).

Note: issue #60 is also listed under the error-handling hygiene tracking issue
because its symptom (opaque Internal Error) fits that cluster as well.