…hase 1)

Introduce `src/jwt.rs` — a single module that owns all `jsonwebtoken`
usage (key loading, signing, verification, algorithm selection).

Key changes:

- Move `JsonWebToken` service from `services::authentication` to `jwt`
  module, covering both session and email-verification tokens.
- Move `UserClaims` from `models::user` and `VerifyClaims` from
  `mailer` into `jwt`, co-located with the code that produces and
  consumes them.
- Rename config field `user_claim_token_pepper` → `jwt_signing_secret`
  (with legacy alias accepted during config loading).
- Add `session_token_lifetime_secs` and
  `email_verification_token_lifetime_secs` config options, replacing
  the hard-coded magic numbers.
- Make `sign()` return `Result` instead of panicking on encoding
  failure.
- Make `parse_token()` return `Result<String, AuthError>` instead of
  panicking on malformed `Authorization` headers.
- Propagate the `JsonWebToken` service via `Arc` into `mailer::Service`
  and `user::RegistrationService`, removing their direct `jsonwebtoken`
  crate dependencies.

BREAKING CHANGE: The config key `auth.user_claim_token_pepper` is
renamed to `auth.jwt_signing_secret`. The old key is still accepted
at startup but the canonical name has changed. The settings JSON
response now includes `jwt_signing_secret`,
`session_token_lifetime_secs`, and
`email_verification_token_lifetime_secs` fields.

…T-007 Phase 4)

Add a `token_generation` column to `torrust_users` and embed a `gen`
claim in every session JWT. Password changes, admin-role grants, and
bans increment the counter, instantly invalidating all outstanding
tokens for that user.

Revocation is checked at three entry points (defence in depth):
- `Authentication::get_user_id_from_bearer_token`
- `verify_token_handler`
- `authentication::Service::renew_token`

Rework the `BearerToken` extractor to reject missing or malformed
`Authorization` headers at the extraction boundary instead of deferring
the check downstream. Remove the `bearer_token::Extract` wrapper and
`get_optional_logged_in_user` free function; the logic now lives
directly in the extractors.

Add `AuthError::TokenRevoked` for revoked-token responses.

Add crate tests for the JWT module (sign/verify round-trips, audience
cross-contamination, tampered tokens) and for `parse_token` (whitespace
trimming, empty bearer, non-ASCII rejection).

Copy the RS256 key pair into the volume-mounted storage path during
E2E install for both SQLite and MySQL setups, aligning the container
environment with the HMAC→RS256 migration (ADR-T-007 Phase 3).

Also make `wait_for_container_to_be_healthy.sh` directly invocable by
forwarding arguments to the function it defines.

…-T-007 Phase 5)

Remove the development RSA key pair shipped at `share/default/jwt/`
and replace it with on-demand ephemeral key generation. When no
`private_key_path`/`public_key_path` or inline PEM values are
configured, the server auto-generates an RSA-2048 key pair in memory
at startup via the `rsa` crate. Sessions work immediately but do not
survive restarts — deployers who want persistent sessions supply
their own key pair.

Key changes:

- `Auth::resolve_{private,public}_key_pem()` now return `Option`
  instead of panicking, letting `JsonWebToken::new()` decide whether
  to use host-supplied or ephemeral keys.
- `JsonWebToken::new()` matches on (Some, Some) / (None, None) and
  panics on mismatched key configuration.
- `generate_ephemeral_key_pair()` offloads CPU-heavy RSA generation
  to a blocking Tokio task.
- Default config no longer includes key paths; all container configs,
  e2e scripts, compose.yaml, and docs updated accordingly.
- Tests now exercise the ephemeral code path by default.
- ADR-T-007 updated with Phase 5/6 design, migration notes, and
  testing strategy.�

…R-T-007 Phase 6)

Add the `torrust-generate-auth-keypair` binary that generates an
RSA-2048 key pair and writes both PEM blocks to stdout. The tool
refuses to run when stdout is a terminal, uses structured JSON
tracing on stderr, and supports a `--debug` flag for verbose output.

The container entry script now auto-generates persistent auth keys on
first boot into `/etc/torrust/index/auth/` with restrictive
permissions (0400 private, 0440 public). A `mktemp` + `trap` pattern
ensures key material is never world-readable and the temp file is
cleaned up on interruption.

Changes:
- New binary: src/bin/generate_auth_keypair.rs
- Containerfile: copy new binary in both debug and release stages
- entry_script_sh: key-generation block before `exec su-exec`
- All container configs: set auth key paths to /etc/torrust/index/auth/
- ADR-007: update Phase 6 to reflect implementation
- docs/containers.md: document auth/ directory and volume layout
- README: note container auto-generation for new users

…DR-T-007)

Introduce atomic database methods that combine state changes with
`token_generation` bumps in a single transaction, closing the race
window where a password change or ban could commit but the generation
increment could fail — leaving revoked credentials with valid tokens:

- `change_user_password_and_revoke_tokens` (transaction)
- `ban_user_and_revoke_tokens` (transaction)
- `grant_admin_role_and_revoke_tokens` (single UPDATE)

Harden token-generation checking from `<` to `!=` (exact match) at
all three validation sites so tokens are also rejected when the
database generation *decreases* (e.g. restore from backup).

Add defence-in-depth `is_user_banned` checks after generation
validation — if `token_generation` somehow matches despite an active
ban, the ban table catches it.

Other fixes included in this changeset:

- `BearerToken::value()` → `as_str()`: return `&str` instead of
  cloning.
- `parse_token`: require the space in `"Bearer "` prefix
  (`strip_prefix("Bearer")` → `strip_prefix("Bearer ")`).
- `get_token_generation`: distinguish `RowNotFound` from other
  errors; replace `unwrap_or(0)` with proper error propagation.
- `Settings::remove_secrets_from_settings`: conditionally redact
  `Option` key fields instead of unconditionally overwriting `None`
  with `Some("***")`. Also redact public key pem/path.
- Warn when configured key paths don't exist (falling back to
  ephemeral keys).
- Replace hardcoded JWT tokens in doc examples with `<JWT_TOKEN>`.
- Fix doc typo: "JWT is not invalid" → "JWT is invalid".

Condense ADR-T-007 and add Phase 7 (consolidate session validation)
design.

- Parse Bearer scheme case-insensitively per RFC 7235 §2.1
- Replace `parse_from_str` + `expect` with a `LazyLock` constant for
  the permanent-ban expiry date, removing two panic sites
- Propagate `is_user_banned` errors with `?` instead of swallowing
  them via `unwrap_or(false)`
- Use `saturating_sub` for token-expiry arithmetic to avoid underflow