fix: restore shared HS256 authentication

auth/src/test/java/com/baiyue/auth/service/AuthServiceSmallJwtTest.java

@@ -12,6 +12,7 @@ import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.oauth2.jose.jws.MacAlgorithm;
 import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.security.oauth2.jwt.JwtEncoder;
 import org.springframework.security.oauth2.jwt.JwtEncoderParameters;
@@ -39,7 +40,7 @@ class AuthServiceSmallJwtTest {
     static class TestConfig {
         @Bean
         AuthSecurityProperties properties() {
-            return new AuthSecurityProperties("unused", "auth-service", "lastleg-api", "{}", "current-2026-08",
+            return new AuthSecurityProperties("unused", "auth-service", "lastleg-api",
                     Duration.ofMinutes(30),
                     Duration.ofDays(7), 5, Duration.ofMinutes(10));
         }
@@ -82,7 +83,8 @@ class AuthServiceSmallJwtTest {
                 .containsEntry("membership_id", 84L)
                 .doesNotContainKeys("permissions", "scope");
         assertThat(jwt.getValue().getClaims().getAudience()).containsExactly("lastleg-api");
-        assertThat(jwt.getValue().getJwsHeader().getKeyId()).isEqualTo("current-2026-08");
+        assertThat(jwt.getValue().getJwsHeader().getAlgorithm()).isEqualTo(MacAlgorithm.HS256);
+        assertThat(jwt.getValue().getJwsHeader().getKeyId()).isNull();
         verify(tokenSessionStore).store(any(), org.mockito.ArgumentMatchers.eq(42L),
                 org.mockito.ArgumentMatchers.eq(Set.of("PLATFORM_ADMIN")),
                 org.mockito.ArgumentMatchers.eq(Set.of("platform:order:list")), any(),