ci: set app_oauth__jwtSecret for test runs

routes/oauth.js now validates jwtSecret at module load time, so CI must
provide a non-placeholder value for the test runner.

Co-Authored-By: Claude <noreply@anthropic.com>

.github/workflows/pr-tests.yml

@@ -136,6 +136,10 @@ jobs:
           # directory layout (dc=example,dc=com) -- only the admin password
           # (normally supplied via a gitignored secrets.js) needs setting.
           app_ldap__bindPassword: your-ldap-password
+          # routes/oauth.js now refuses to start without a real jwtSecret.
+          # This is a non-secret test value; the container under test uses
+          # secrets.js.example's jwtSecret independently.
+          app_oauth__jwtSecret: ci-test-jwt-secret-do-not-use-in-production
         run: npm test
 
   test-summary:

CHANGELOG.md

@@ -16,6 +16,7 @@ correspond to git tags (`vX.Y.Z`) and `nodejs/package.json`'s `version`.
 
 ### Changed
 - Public-release packaging: removed `"private": true` from `nodejs/package.json` and bumped version to `1.1.16`.
+- CI workflow (`.github/workflows/pr-tests.yml`) now sets `app_oauth__jwtSecret` so the test suite can run against the new startup-time JWT validation.
 
 ### Fixed
 - `models/email.js`: fixed a template bug where the rendered `from` address used `template.message` instead of `template.from`.