feat(passenger-api): integrate @tria-plc IAM package (dual-ORM iam schema + package auth guard)

apps/edr-passenger-api/.env.example

@@ -2,17 +2,46 @@
 NODE_ENV=development
 PORT=3002
 
-# Database (Prisma)
-DATABASE_URL=postgresql://edr:edr_secret@localhost:5432/edr_passenger?schema=edr_passenger
+# Database (Prisma) — owns the `passenger` schema in edr_database
+DATABASE_URL=postgresql://edr:edr_secret@localhost:5432/edr_database?schema=passenger
+
+# Database (TypeORM / @tria-plc IAM) — shared `iam` schema in the SAME edr_database.
+# These mirror the connection vars read by @tria-plc/api-common's TypeORM DataSource.
+DATABASE_HOST=localhost
+DATABASE_PORT=5432
+DATABASE_NAME=edr_database
+DATABASE_USER=edr
+DATABASE_PASSWORD=edr_secret
+DATABASE_SCHEMA=iam
+
+# RabbitMQ — the @tria-plc IAM/notification modules register RMQ clients (SMS/notifications).
+# Connects lazily; a broker is only needed when those features actually send. Placeholder for dev.
+RABBITMQ_URL=amqp://localhost:5672
+
+# MinIO — the @tria-plc file/notification modules construct a MinIO client at boot (validates these).
+# Placeholders for dev; only contacted when file upload/download features are actually used.
+MINIO_ENDPOINT=localhost
+MINIO_PORT=9000
+MINIO_USE_SSL=false
+MINIO_ACCESS_KEY=minioadmin
+MINIO_SECRET_KEY=minioadmin
+MINIO_BUCKET=edr-dev
 
 # CORS
 FRONTEND_URL=http://localhost:5174
 BACK_OFFICE_URL=http://localhost:5184
 
-# JWT
+# JWT (legacy passenger auth — being replaced by IAM)
 JWT_SECRET=edr-platform-secret-change-in-production
 JWT_EXPIRES_IN=7d
 
+# @tria-plc IAM token contract — the package's JwtGuard/verifyToken + AuthService sign/verify with
+# these. MUST match the IAM issuer's secret in shared deployments. (Expiry strings use jsonwebtoken/ms.)
+JWT_ACCESS_TOKEN_SECRET=dev-iam-access-secret-change-me
+JWT_ACCESS_TOKEN_EXPIRES=1h
+JWT_REFRESH_TOKEN_SECRET=dev-iam-refresh-secret-change-me
+JWT_REFRESH_TOKEN_EXPIRES=7d
+
 # SendGrid
 SENDGRID_API_KEY=
 SENDGRID_FROM_EMAIL=noreply@edr-platform.com