test(admin): exercise webhook signing-key rotation router (Closes #1307)

[esegbueadam-sys]

• Add src/routes/admin/webhookKeys.test.ts (27 tests) driving POST /rotate-key and GET /grace-window through supertest with an injected InMemoryWebhookKeyStore, behind the real adminAuth middleware (restored; see below).

Acceptance criteria covered:

• Rotation demotes the prior key to 'previous' with exact expiry (fixed clock + injected grace window, asserted at store level).
• A second/third rotation expires the oldest key; expired keys leave the valid-previous set.
• Invalid graceWindowMs overrides (0, negative, fractional, string, null, NaN, Infinity, unknown fields) return 400 VALIDATION_ERROR with field details and mutate nothing (no rotation, no audit row, no notification).
• Audit records (store rows + HTTP-layer logger.audit) carry actor and key ids and never raw secrets; only SHA-256 hashes persist.
• Auth enforcement: 401 without/wrong credentials or non-admin JWT; admin JWT subject recorded as rotation actor.
• Failure modes: store errors map to 500 without leaking internals; mid-rotation demotion failure leaves no partial state.

Production changes (minimal, to expose the tested behavior):

• WebhookSignerService.rotateKey accepts an optional per-rotation graceWindowMs override, validated before any state mutation; audit rows and results reflect the effective window. Service default unchanged.
• rotate-key route validates an optional strict JSON body { graceWindowMs?: positive int } via the shared validate() middleware (bodyless/empty-body requests remain valid) and forwards the override. OpenAPI comment updated.

Workspace repairs required to run tests (reconstructed, not re-written): restore src/middleware/adminAuth.ts verbatim from 092ece9~1 (it was deleted while its test and importers remained), and restore package.json / jest.env-setup.cjs so npm test works.

Validation: npm test -- src/routes/admin/webhookKeys.test.ts => 27/27 passing; webhookSigner.test.ts unchanged (48/50, same two pre-existing failures); tsc error count identical to baseline.

Closes #1307

[drips-wave]

@esegbueadam-sys Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits