feat(auth): GET /auth/module-identity — identity + module gate

Adds the route (cookie auth via verifyAccessToken, module gate seqid 31,
X-Auth-* headers, admin via seqid set). Adds a jest setupFiles hook giving a
dummy DUC_URL for module-load-time env reads, which also unblocks the
pre-existing authentication.guard.spec.

Co-Authored-By: WOZCODE <contact@withwoz.com>

src/modules/auth/auth.controller.ts

@@ -32,6 +32,12 @@ import {
 } from '@dadosfera/protospack-v2/dist/lib/Duc/interfaces/messages';
 
 import { PERMISSIONS_GROUPS } from 'src/authentication/permissions.enum';
+import {
+  parseAdminSeqids,
+  moduleGateSeqid,
+  isModuleAllowed,
+  isAdmin,
+} from './orchest-identity';
 import {
   Authenticated,
   RequireAllPermissions,
@@ -531,4 +537,44 @@ export class AuthController {
       return res.status(200).json(user);
     }
   }
+
+  /**
+   * Ingress auth subrequest for Orchest (see dbt-to-orchest
+   * docs/superpowers/specs/2026-08-20-maestro-module-identity-design.md).
+   *
+   * Authenticates the ddf-auth cookie, gates on the module permission, and
+   * returns the X-Auth-* identity headers orchest-api trusts. Never writes
+   * cookies (an auth_request response cannot). No token refresh: an expired
+   * token is a 401 (the signin flow re-auths).
+   */
+  @Get('module-identity')
+  async moduleIdentity(@Req() req: Request, @Res() res: Response) {
+    const token = req.cookies?.['ddf-auth'];
+    if (!token) {
+      return res.status(401).send();
+    }
+
+    let payload: any;
+    try {
+      payload = await this.authClient.verifyAccessToken(token);
+    } catch (e) {
+      return res.status(401).send();
+    }
+
+    const perms: number[] = payload?.permissions ?? [];
+    const gate = moduleGateSeqid(process.env.ORCHEST_MODULE_PERMISSION_SEQID);
+    if (!isModuleAllowed(perms, gate)) {
+      return res.status(403).send();
+    }
+
+    res.set('X-Auth-User', String(payload.user_id));
+    res.set('X-Auth-Username', String(payload.username ?? ''));
+    if (
+      isAdmin(perms, parseAdminSeqids(process.env.ORCHEST_ADMIN_PERMISSION_SEQIDS))
+    ) {
+      res.set('X-Auth-Roles', 'admin');
+    }
+
+    return res.status(200).send();
+  }
 }