fix(services): add JWT Bearer auth middleware and OIDC discovery to 6 microservices

- Added UseAuthentication() + UseAuthorization() middleware after UseRouting()
- Added AddAuthentication().AddJwtBearer() with OIDC authority discovery
- Added Microsoft.AspNetCore.Authentication.JwtBearer NuGet package
- Affected: Merchant, Catalog, Order, Inventory, FnB Engine, Booking services
- Tokens validated via IAM IdentityServer OIDC discovery endpoint

Co-authored-by: Velik <hongochai10@users.noreply.github.com>

services/merchant-service-net/src/MerchantService.API/MerchantService.API.csproj

@@ -14,6 +14,7 @@
     <!-- EN: FluentValidation for request validation / VI: FluentValidation cho validation request -->
     <PackageReference Include="FluentValidation" Version="11.11.0" />
     <PackageReference Include="FluentValidation.DependencyInjectionExtensions" Version="11.11.0" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.1" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.2">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>

services/merchant-service-net/src/MerchantService.API/Program.cs

@@ -89,6 +89,23 @@ try
             name: "postgresql",
             tags: ["db", "postgresql"]);
 
+    // EN: Add JWT Bearer authentication via IAM IdentityServer OIDC discovery
+    // VI: Thêm JWT Bearer authentication qua IAM IdentityServer OIDC discovery
+    var jwtAuthority = builder.Configuration["Jwt:Authority"] ?? "http://localhost:5001";
+    builder.Services.AddAuthentication(Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerDefaults.AuthenticationScheme)
+        .AddJwtBearer(options =>
+        {
+            options.Authority = jwtAuthority;
+            options.RequireHttpsMetadata = false;
+            options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
+            {
+                ValidateIssuer = false,
+                ValidateAudience = false,
+                ValidateLifetime = true,
+            };
+        });
+    builder.Services.AddAuthorization();
+
     // EN: Add CORS / VI: Thêm CORS
     builder.Services.AddCors(options =>
     {
@@ -118,6 +135,8 @@ try
 
     app.UseCors();
     app.UseRouting();
+    app.UseAuthentication();
+    app.UseAuthorization();
 
     // EN: Map health check endpoints / VI: Map health check endpoints
     app.MapHealthChecks("/health");