test(07.2-01): add JTI claim xfail stub to test_task2_auth_service.py

- Add test_create_access_token_includes_jti_claim with xfail(strict=False)
- Asserts 'jti' key present in decoded payload, parseable as UUID
- Wave 1 (Plan 02) will add jti to create_access_token to promote this stub
- All 17 existing tests unaffected

backend/tests/test_task2_auth_service.py

@@ -194,6 +194,17 @@ async def test_rotate_revoked_token_raises(db_session):
             await rotate_refresh_token(db_session, raw)
 
 
+@pytest.mark.xfail(strict=False, reason="Phase 7.2 Wave 1 — jti claim not yet added to create_access_token")
+def test_create_access_token_includes_jti_claim():
+    """create_access_token payload must include a 'jti' key with a UUID-format string value."""
+    import uuid
+    from services.auth import create_access_token, decode_access_token
+    t = create_access_token("test-uid", "user")
+    payload = decode_access_token(t)
+    assert "jti" in payload, "jti claim missing from access token payload"
+    uuid.UUID(payload["jti"])  # raises ValueError if not a valid UUID
+
+
 @pytest.mark.asyncio
 async def test_store_and_verify_backup_codes(db_session):
     """store_backup_codes inserts rows; verify_backup_code matches correct code."""