fix: 终审识别文件扫——JWKS 失败→503、getNats 在途去重、service-token clientId 取自 config

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

test/unit/keycloak-auth.test.ts

@@ -1,7 +1,8 @@
 import { Hono } from 'hono';
+import { errors as joseErrors } from 'jose';
 import { beforeAll, describe, expect, it } from 'vitest';
 import { makeToken, setupTestJwks } from '../support/token';
-import { requireAuth, requireRealmRole, requireService } from '../../src/shared/keycloak-auth';
+import { classifyAuthError, requireAuth, requireRealmRole, requireService } from '../../src/shared/keycloak-auth';
 
 function appWith(...mw: Parameters<Hono['use']>[1][]): Hono {
   const app = new Hono();
@@ -66,6 +67,22 @@ describe('keycloak-auth', () => {
     expect(res.status).toBe(200);
   });
 
+  it('I4：token 类失败 → 401；JWKS/网络类失败 → 503（不把停机说成凭据无效）', () => {
+    // token 类：换张票才有意义
+    expect(classifyAuthError(new joseErrors.JWTExpired('exp', {}))).toBe(401);
+    expect(classifyAuthError(new joseErrors.JWTClaimValidationFailed('aud', {}, 'aud'))).toBe(401);
+    expect(classifyAuthError(new joseErrors.JWTInvalid('不是 JWT'))).toBe(401);
+    expect(classifyAuthError(new joseErrors.JWSSignatureVerificationFailed())).toBe(401);
+    expect(classifyAuthError(new joseErrors.JWKSNoMatchingKey())).toBe(401);
+    // 基础设施类：只有重试才有意义。回 401 会把客户端赶去重新登录，而登录打的是同一个
+    // 连不上的 Keycloak——排障时看到的也只是一片"凭据无效"，而非依赖不可用。
+    expect(classifyAuthError(new TypeError('fetch failed'))).toBe(503);
+    expect(classifyAuthError(new joseErrors.JWKSTimeout())).toBe(503);
+    expect(classifyAuthError(new joseErrors.JWKSInvalid('JWKS 结构不对'))).toBe(503);
+    expect(classifyAuthError(new joseErrors.JOSEError('Expected 200 OK from the JSON Web Key Set HTTP response'))).toBe(503);
+    expect(classifyAuthError('连字符串都不是')).toBe(503);
+  });
+
   it('requireService：service 角色＋azp 白名单', async () => {
     const svc = await makeToken({
       roles: ['service'], azp: 'task-dispatcher', username: 'service-account-task-dispatcher',