Phase 4: Auth matrix testing — RBAC roles + JWT expiry/replay checks

[ToryMic]

Goal

Extend the single 'no credentials at all' auth check into a full role-based access matrix, plus token-lifecycle checks.

Scope

• Declare multiple roles/tokens in config (e.g. admin, user, guest) and a per-endpoint matrix of which roles should get 200 vs 403.
• JWT expiry check: replay a request with an expired token, assert 401 (not a crash, not a silent pass).
• JWT tampering check: flip a byte in the signature, assert rejection.
• Replay check: reuse a one-time-use token/nonce if the API declares one, assert rejection on second use.

Why

Phase 1's auth check only proves 'no token' is rejected. The more common real-world bug class in Wave backends is 'wrong role gets access it shouldn't' (privilege escalation) and 'expired/tampered token silently accepted.'

Acceptance criteria

• A config with 3 roles × 5 endpoints produces a 15-cell pass/fail matrix in the report.
• An expired-token fixture is caught as a failure, not a false pass.