Plan: craig-web BFF JWT-Trust Hardening (#813 + #814 + #812)

Issues: #813, #814 (MR-A, closed); #812 (MR-B)
Branches: feature/p3low-web-oidc-verify (A, merged), feature/p3low-web-write-guard (B)
MRs: !926 (A, merged cf4257ef); MR-B (this MR)

An audit flagged three related weaknesses in the craig-web BFF’s OIDC/session trust model. All are P3-low with existing mitigations (AES-GCM session cookie + backends re-verify the forwarded bearer
backend fail-closed authz.check), but architecturally the BFF trusts token contents it never verifies and treats a role it never enforces as display-only. Pre-1.0 ⇒ no backwards-compat is owed.

Decisions:

verify_login_tokens(id_verifier, access_verifier, id_token, access_token, expected_nonce): verify id_token → nonce match → verify access_token → subject match → at_hash match (when present) → return the access-token claims. validate_with_refresh retries once on JwksNotLoaded / NoMatchingKey (boot-warm miss + key rotation). build_session_from_claims moves the verified claims into a WebSession. access_token_hash computes the OIDC at_hash (base64url of the left-most half of SHA-256(access_token)). Any failure is a hard login rejection.

Two craig_auth::jwks::JwksProvider fields, built from the already-warmed AppState.oidc via from_discovery: the id verifier binds aud+azp = the login client and typ:"ID"; the access verifier enforces azp only (craig-web is not in the access token’s aud). Both warmed best-effort at boot (mirrors build_oidc) + a background refresh task. JwksProvider is Clone (an Arc-backed key cache), so the per-request AppState::clone() stays a refcount bump.

PkceState gains a nonce field (no serde(default) — a pre-deploy cookie lacking it fails deserialize → re-login, fail-closed). login mints a nonce, stores it in the signed PKCE cookie, and emits &nonce= in the authorize URL. callback extracts the id/access tokens from the exchange response (the serde_json::Value boundary stays in auth.rs), verifies them via auth_verify, and builds the session from the verified claims. The unverified build_session_from_token
decode_claims_unverified helpers are deleted; the id_token is verified then discarded.

require_write_access middleware (mirrors verify_csrf’s method discrimination): pass safe methods; pass the `/personalize/ self-service subtree (own-user_sub-scoped, ADR-035 §3); else read the injected SessionUser (missing → 403 fail-closed) and 403 a sole-readonly principal. Wired inner to require_auth (it needs the injected SessionUser) and outer of the per-route role gates, so the per-request order is verify_csrf → require_auth → require_write_access → [role gate] → handler. /set-locale is on a separate router outside these layers, so locale stays available to readonly.

Harness: craig_auth::jwks::test_fixtures::{test_jwk_set, TEST_ISSUER, TEST_KID}
JwksProvider::inject_keys (bypasses the network) + craig_test_lib::jwt_mutation::ClaimsBuilder (mints against the shared key).

Battery per MR: cargo nextest run --workspace (shared-crate change ⇒ full run); clippy -D warnings; cargo xtask quality-budgets (B4/B3a/B5 unchanged vs lock); validate --skip-docker + check-docs + plan-lint; a fresh contextless J1–J8 subagent over each staged diff.

Manual devstack: log in as jane.doe; base64-decode the exchange id_token → typ:"ID", nonce matches the /login redirect, azp==craig-ui, at_hash present; access_token → typ:"Bearer", azp==craig-ui; mismatched issuer/aud → login redirects /welcome; a readonly scratch user is 403’d on POST /cases/ but 200 on GET /cases/ and POST /personalize/dashboard/reset.

Two MRs, sequential, each: implement on a branch, run the battery, present the diff, no autonomous merge. On MR-B completion this plan’s Status → all Done, nav entry → Archive.