Auth is now handled by Logto. Removed AuthController, AuthService,
and related DTOs. Integration tests use Spring Security JWT mocks.
Ed25519 JwtService retained for machine token signing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Creates Logto organizations when tenants are created. Authenticates
via M2M client credentials. Gracefully skips when Logto is not
configured (dev/test mode).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Dual auth: machine endpoints use Ed25519 JWT filter, all other API
endpoints use Spring Security OAuth2 Resource Server with Logto OIDC.
Mock JwtDecoder provided for test isolation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
POST /api/tenants/{id}/license generates Ed25519-signed license JWT.
GET /api/tenants/{id}/license returns active license.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Generates tier-aware license tokens with features/limits per tier.
Verifies signature and expiry. Audit logged.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
