build(security): add migration and CI security gates

backend/tests/test_jwt_security.py

@@ -0,0 +1,10 @@
+from app.config import settings
+from app.utils.security import create_access_token, decode_token
+
+
+def test_jwt_round_trip_and_tamper_rejection(monkeypatch):
+    monkeypatch.setattr(settings, "SECRET_KEY", "x" * 32)
+    token = create_access_token({"user_id": "user-1", "role": "manager"})
+
+    assert decode_token(token)["user_id"] == "user-1"
+    assert decode_token(f"{token}tampered") is None