LINUS ROUND 5: RS256 default auth, middleware, full integration

- main.go: RS256Service with AAMOS public key, fallback to HS256
- auth/rs256.go: Middleware() for RS256 Bearer validation
- auth/rs256_test.go: 6 RS256 tests (middleware + validation)
- 27/27 auth tests passing, 82.6% coverage
- Build passes, all services operational

backend/auth/rs256_test.go

@@ -5,6 +5,8 @@ import (
 	"crypto/rsa"
 	"crypto/x509"
 	"encoding/pem"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"testing"
 	"time"
@@ -152,6 +154,77 @@ func TestRS256Service_ValidateToken_Expired(t *testing.T) {
 	assert.Error(t, err)
 }
 
+func TestRS256Service_Middleware_ValidToken(t *testing.T) {
+	privateKey, pubPEM := generateTestKeyPair(t)
+
+	tmpFile, err := os.CreateTemp("", "test-pub-*.pem")
+	require.NoError(t, err)
+	defer os.Remove(tmpFile.Name())
+
+	_, err = tmpFile.Write(pubPEM)
+	require.NoError(t, err)
+	tmpFile.Close()
+
+	svc, err := NewRS256Service(tmpFile.Name())
+	require.NoError(t, err)
+
+	// Issue a valid token
+	now := time.Now().Unix()
+	claims := jwt.MapClaims{
+		"sub":   "user-123",
+		"email": "test@example.com",
+		"iss":   "prexo-identity",
+		"aud":   "prexo",
+		"iat":   now,
+		"exp":   now + 3600,
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)
+	tokenString, err := token.SignedString(privateKey)
+	require.NoError(t, err)
+
+	// Test middleware
+	handler := svc.Middleware()(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		validatedClaims, ok := FromContext(r.Context())
+		require.True(t, ok)
+		assert.Equal(t, "user-123", validatedClaims.Sub)
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/api/test", nil)
+	req.Header.Set("Authorization", "Bearer "+tokenString)
+	rr := httptest.NewRecorder()
+
+	handler.ServeHTTP(rr, req)
+	assert.Equal(t, http.StatusOK, rr.Code)
+}
+
+func TestRS256Service_Middleware_InvalidToken(t *testing.T) {
+	_, pubPEM := generateTestKeyPair(t)
+
+	tmpFile, err := os.CreateTemp("", "test-pub-*.pem")
+	require.NoError(t, err)
+	defer os.Remove(tmpFile.Name())
+
+	_, err = tmpFile.Write(pubPEM)
+	require.NoError(t, err)
+	tmpFile.Close()
+
+	svc, err := NewRS256Service(tmpFile.Name())
+	require.NoError(t, err)
+
+	handler := svc.Middleware()(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("should not reach handler")
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/api/test", nil)
+	req.Header.Set("Authorization", "Bearer invalid-token")
+	rr := httptest.NewRecorder()
+
+	handler.ServeHTTP(rr, req)
+	assert.Equal(t, http.StatusUnauthorized, rr.Code)
+}
+
 func TestRS256Service_ValidateToken_HS256(t *testing.T) {
 	_, pubPEM := generateTestKeyPair(t)