feat(headless-login): add jwks cache visibility and refresh flow

- replace inline headless jwks support with jwksUri-only validation
- add cached jwks refresh worker, manual refresh/revoke endpoints, and parsed key summaries
- expose allowed algorithms and key previews in DevFront with regression coverage

devfront/tests/helpers/devfront-fixtures.ts

@@ -15,6 +15,27 @@ export type Client = {
   tokenEndpointAuthMethod?: string;
   jwksUri?: string;
   jwks?: Record<string, unknown> | string;
+  headlessJwksCache?: {
+    clientId: string;
+    jwksUri: string;
+    cachedAt: string;
+    expiresAt: string;
+    lastCheckedAt?: string;
+    lastSuccessfulVerificationAt?: string;
+    lastRefreshStatus?: "success" | "failure" | "pending";
+    lastError?: string;
+    consecutiveFailures?: number;
+    cachedKids?: string[];
+    etag?: string;
+    lastModified?: string;
+    parsedKeys?: Array<{
+      kid?: string;
+      kty?: string;
+      use?: string;
+      alg?: string;
+      n?: string;
+    }>;
+  };
   metadata?: Record<string, unknown>;
 };
 
@@ -53,6 +74,8 @@ export type DevApiMockState = {
   auditLogs?: AuditLog[];
   onUpdateStatus?: (status: ClientStatus) => void;
   onRotateSecret?: (newSecret: string) => void;
+  onRefreshHeadlessJwks?: (clientId: string) => void;
+  onRevokeHeadlessJwksCache?: (clientId: string) => void;
 };
 
 export function makeClient(
@@ -337,13 +360,6 @@ export async function installDevApiMock(page: Page, state: DevApiMockState) {
       });
     }
 
-    if (pathname.startsWith("/api/v1/dev/clients/") && method === "DELETE") {
-      const clientId = parseClientId(pathname);
-      state.clients = state.clients.filter((client) => client.id !== clientId);
-      appendAuditLog("CLIENT_DELETE", "DELETE_CLIENT", clientId);
-      return route.fulfill({ status: 204 });
-    }
-
     if (pathname.startsWith("/api/v1/dev/clients/") && method === "GET") {
       const clientId = parseClientId(pathname);
       const found = state.clients.find((client) => client.id === clientId);
@@ -357,9 +373,56 @@ export async function installDevApiMock(page: Page, state: DevApiMockState) {
           token: "https://issuer/oauth2/token",
           userinfo: "https://issuer/userinfo",
         },
+        headlessJwksCache: found.headlessJwksCache,
       });
     }
 
+    if (
+      pathname.startsWith("/api/v1/dev/clients/") &&
+      pathname.endsWith("/headless-jwks/cache") &&
+      method === "DELETE"
+    ) {
+      const clientId = pathname.split("/")[5] ?? "";
+      const found = state.clients.find((client) => client.id === clientId);
+      if (!found) return json(route, { error: "not found" }, 404);
+      found.headlessJwksCache = undefined;
+      state.onRevokeHeadlessJwksCache?.(clientId);
+      return route.fulfill({ status: 204 });
+    }
+
+    if (
+      pathname.startsWith("/api/v1/dev/clients/") &&
+      pathname.endsWith("/headless-jwks/refresh") &&
+      method === "POST"
+    ) {
+      const clientId = pathname.split("/")[5] ?? "";
+      const found = state.clients.find((client) => client.id === clientId);
+      if (!found) return json(route, { error: "not found" }, 404);
+      state.onRefreshHeadlessJwks?.(clientId);
+      return json(route, {
+        client: found,
+        endpoints: {
+          discovery: "https://issuer/.well-known/openid-configuration",
+          issuer: "https://issuer",
+          authorization: "https://issuer/oauth2/auth",
+          token: "https://issuer/oauth2/token",
+          userinfo: "https://issuer/userinfo",
+        },
+        headlessJwksCache: found.headlessJwksCache,
+      });
+    }
+
+    if (
+      pathname.startsWith("/api/v1/dev/clients/") &&
+      !pathname.endsWith("/headless-jwks/cache") &&
+      method === "DELETE"
+    ) {
+      const clientId = parseClientId(pathname);
+      state.clients = state.clients.filter((client) => client.id !== clientId);
+      appendAuditLog("CLIENT_DELETE", "DELETE_CLIENT", clientId);
+      return route.fulfill({ status: 204 });
+    }
+
     if (pathname === "/api/v1/dev/consents" && method === "GET") {
       const subject = searchParams.get("subject") || "";
       const clientId = searchParams.get("client_id") || "";