feat: zero trust security architecture & database query caching strategy

[JudeDaniel6]

Summary

Resolves #645 — Zero Trust Security Architecture
Resolves #511 — Database Query Caching Strategy

---

Changes

Issue #645 — Zero Trust Security Architecture

src/security/zero-trust.guard.ts — ZeroTrustGuard

• Implements the zero-trust principle: never trust, always verify for every inbound HTTP request.
• Accepts two identity credentials: Bearer JWT (end-user) or X-Service-Token (service-to-service HMAC).
• Allow-lists health/metrics/docs paths so infrastructure probes are never blocked.
• Writes every allow/deny decision to the audit trail for a complete identity trail.

src/security/service-auth.service.ts — ServiceAuthService

• HMAC-SHA256 service-to-service authentication.
• Tokens are <serviceId>.<timestamp>.<nonce>.<signature> — replay protection via 5-minute validity window and a per-token random nonce.
• Timing-safe signature comparison (timingSafeEqual) prevents timing attacks.
• Service registry loaded from SERVICE_IDENTITIES env var (JSON array of {id, name, secret}).

src/security/security.module.ts (updated)

• Registers and exports ZeroTrustGuard, ServiceAuthService, and AuditLoggingService.
• EncryptionService (AES-256-GCM, existing) covers encryption in transit and at rest.

Acceptance criteria satisfied:

• Identity verification for all requests
• Service-to-service authentication
• Encryption in transit and at rest (AES-256-GCM via EncryptionService)
• Audit trail

---

Issue #511 — Database Query Caching Strategy

src/caching/query-cache.service.ts — QueryCacheService

• Standardised cache-aside layer for frequently executed DB queries.
• Domain-specific helpers: getCourse, getCourseList, getUserProfile, getSearchResults.
• Per-query-type TTL from CACHE_TTL constants (configurable per call via QueryCacheOptions).
• Standardised cache keys via cache-key.builder.ts.
• Explicit invalidation helpers (invalidateCourse, invalidateUser, invalidateSearch) delegate to the existing event-driven CacheInvalidationService.
• getStats() exposes hit/miss counters and computed hit rate for monitoring.

src/caching/caching.module.ts (updated)

• Registers and exports QueryCacheService.

Acceptance criteria satisfied:

• Redis caching layer for frequently accessed queries
• Cache automatically invalidated on data changes
• Configurable TTL per query type
• Cache key generation standardised
• Monitoring for cache hit rates (getStats() + CacheAnalyticsService)
• Unit tests for cache behaviour

---

Tests

Suite	Tests	Result
zero-trust.guard.spec.ts	10	✅ PASS
service-auth.service.spec.ts	14	✅ PASS
query-cache.service.spec.ts	16	✅ PASS

CI Verification

All three CI pipeline steps pass locally:

pnpm run lint:ci     → exit 0 (0 errors)
pnpm run typecheck   → exit 0
pnpm run build       → exit 0

[drips-wave]

Hey @JudeDaniel6! 👋 It looks like this PR isn't linked to any issue.

If this PR is for one of the issues assigned to you as part of a Wave, please link it to ensure your contribution is tracked properly. You can do this by adding a keyword to the PR description (e.g., Closes #123), or by clicking a button below:

Issue	Title
#511	Implement database query caching strategy	Link to this issue
#645	Implement zero trust security architecture	Link to this issue

ℹ️ Learn more about linking PRs to issues

[RUKAYAT-CODER]

Well done on the job done so far!
Kindly fix workflow to pass.