I added JWT auth with Ed25519 signing. Now login returns access + refresh token pair, refresh rotates tokens, logout blacklists the refresh token in Redis. JWKS endpoint exposed at /.well-known/jwks.json for other services to verify tokens.