Fase A identity on PCB HEAD: operator fence, keep BOM/SPOF/EMI.

Replace Faradworks Inc. TOS/privacy/contact/metadata with Michele Bigi.
Dual-read pinscope_* keys; write periscope_* only. AGPL LICENSE and
GitHub fork parent unchanged. validate.py not edited.

tests/test_pinscope_compat.py

@@ -0,0 +1,45 @@
+"""Fase A identity fence — dual-read PinScope issuers, write Periscope only."""
+
+from datetime import datetime, timedelta, timezone
+
+import jwt
+
+from backend.pinscope_compat import JWT_ISSUER, LEGACY_JWT_ISSUERS
+from backend.services.local_jwt import ALGORITHM, decode_token, issue_token
+
+
+def test_issue_token_uses_periscope_issuer(monkeypatch):
+    from backend.config import settings
+
+    monkeypatch.setattr(settings, "auth_jwt_secret", "unit-test-secret-32-bytes-min!!")
+    token = issue_token("usr_test", "a@b.c")
+    payload = jwt.decode(
+        token,
+        "unit-test-secret-32-bytes-min!!",
+        algorithms=[ALGORITHM],
+        issuer=JWT_ISSUER,
+        options={"verify_aud": False},
+    )
+    assert payload["iss"] == JWT_ISSUER
+    assert payload["iss"] not in LEGACY_JWT_ISSUERS
+
+
+def test_decode_token_accepts_legacy_pinscope_issuer(monkeypatch):
+    from backend.config import settings
+
+    monkeypatch.setattr(settings, "auth_jwt_secret", "unit-test-secret-32-bytes-min!!")
+    now = datetime.now(timezone.utc)
+    token = jwt.encode(
+        {
+            "sub": "usr_legacy",
+            "email": "old@b.c",
+            "iss": "pinscope-local",
+            "iat": now,
+            "exp": now + timedelta(days=1),
+        },
+        "unit-test-secret-32-bytes-min!!",
+        algorithm=ALGORITHM,
+    )
+    decoded = decode_token(token)
+    assert decoded is not None
+    assert decoded["sub"] == "usr_legacy"