fix(control-panel): sign strict goal approvals via oidc

docker-compose.control-panel.local.yml

@@ -38,6 +38,14 @@ services:
       CASAN_AUTH_BRIDGE_URL: http://host.docker.internal:20130
       CASAN_AUTH_BRIDGE_TOKEN: ${CASAN_AUTH_BRIDGE_TOKEN:-}
       CASAN_PROVIDER_ACCOUNT_AUTH_ENABLED: "1"
+      # Goal approval decisions are signed by the local OIDC test IdP and then
+      # verified by H5. The UI never receives or stores this short-lived JWT.
+      CASAN_APPROVAL_TOKEN_URL: http://idp:8080/token
+      CASAN_APPROVAL_TOKEN_AUTH_TOKEN: ${CASAN_APPROVAL_SIGNER_TOKEN:-local-approval-signer-secret}
+      CASAN_APPROVAL_TOKEN_ALLOWED_HOSTS: idp
+      CASAN_APPROVAL_TOKEN_ALLOW_HTTP: "1"
+      CASAN_APPROVAL_SIGNER_ROLE: ops
+      CASAN_IDP_JWKS_URL: http://idp:8080/.well-known/jwks.json
     volumes:
       - ./.specify:/app/.specify
       - ./docs/output:/app/docs/output:ro
@@ -107,6 +115,7 @@ services:
       CASAN_IDP_SUB: oidc-ops
       CASAN_IDP_EMAIL: oidc-ops@example.com
       CASAN_IDP_GROUPS: casan-org-admin,casan-approver
+      CASAN_APPROVAL_SIGNER_TOKEN: ${CASAN_APPROVAL_SIGNER_TOKEN:-local-approval-signer-secret}
     ports:
       - "18082:8080"
     networks: