authentication improvements

apps/auth/wrangler.jsonc

@@ -26,11 +26,17 @@
 			"id": "local"
 		}
 	],
-	// Preserve environment variables and secrets already set in Cloudflare (e.g.
-	// JWT_SECRET, managed via `wrangler secret put`) instead of clearing them on
-	// deploy — keeps the signing key out of source.
-	"keep_vars": true,
 	"logpush": false,
+	// Shared Secrets Store holding the HS256 JWT signing key. Every worker binds the
+	// same store as JWT_SECRET so tokens signed by `auth` verify here. The "local"
+	// store_id placeholder is replaced with RECFLARE_SECRETS_STORE at deploy time.
+	"secrets_store_secrets": [
+		{
+			"binding": "JWT_SECRET",
+			"store_id": "local",
+			"secret_name": "JWT_SECRET"
+		}
+	],
 	"upload_source_maps": true,
 	"observability": {
 		"logs": {