fix(dashboard): address persistent auth review

tests/test_dashboard_authentication_app.py

@@ -108,6 +108,13 @@ def test_invalid_cookie_blocks_database_and_page_dispatch(monkeypatch):
     assert not at.exception
     assert "관리자 로그인" in _body_text(at)
     assert "이번 달 수입/지출 현황" not in _body_text(at)
+    assert "/api/auth/cleanup" in _body_text(at)
+
+
+def test_no_cookie_does_not_render_cookie_cleanup_navigation(monkeypatch):
+    at = _app_with_cookie(monkeypatch, None)
+
+    assert "/api/auth/cleanup" not in _body_text(at)
 
 
 def test_valid_cookie_allows_dashboard_and_is_not_stored_in_session_state(
@@ -153,3 +160,24 @@ def test_password_rotation_invalidates_existing_cookie(monkeypatch, tmp_path):
 
     assert "관리자 로그인" in _body_text(at)
     assert "이번 달 수입/지출 현황" not in _body_text(at)
+
+
+def test_signing_secret_rotation_invalidates_existing_cookie(monkeypatch, tmp_path):
+    from scripts.ci_fixture_db import create_ci_fixture_db
+
+    fixture = tmp_path / "fixture.sqlite3"
+    create_ci_fixture_db(fixture)
+    monkeypatch.setenv("JARCA_LEDGER_DB_PATH", str(fixture))
+    settings = _configure(monkeypatch)
+    token = authentication.issue_persistent_token(settings, remember_me=True).value
+    monkeypatch.setattr(authentication, "_request_cookie", lambda: token)
+
+    at = AppTest.from_file(str(APP_PATH), default_timeout=30).run()
+    assert "이번 달 수입/지출 현황" in _body_text(at)
+
+    monkeypatch.setenv(authentication.SIGNING_SECRET_ENV, "r" * 64)
+    at = at.run()
+
+    assert "관리자 로그인" in _body_text(at)
+    assert "/api/auth/cleanup" in _body_text(at)
+    assert "이번 달 수입/지출 현황" not in _body_text(at)