Remove backend dev A2A auth fallback

scripts/user-profile.test.ts

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import { config } from "../src/config.js";
+import { resolveTrustedServiceTokens } from "../src/auth/clerk.js";
 import { fetchOnboardingReadProfile, fetchUserProfile, patchPreferencesRequest } from "../src/services/user-profile.js";
 
 /**
@@ -282,5 +283,24 @@ async function runFetchUserProfileAfterBodyConsumed(): Promise<{
     globalThis.fetch = originalFetch;
   }
 }
+// ── 8. trusted token resolution excludes A2A in production ────────────────
+{
+  assert.equal(config.a2aAllowedKey, process.env.A2A_ALLOWED_KEY ?? "", "A2A config must not have a dev fallback");
+  const production = resolveTrustedServiceTokens({
+    nodeEnv: "production",
+    serviceToken: "service-token",
+    a2aAllowedKey: "a2a-token",
+  });
+  assert.equal(production.has("service-token"), true);
+  assert.equal(production.has("a2a-token"), false, "production must exclude A2A token");
+
+  const development = resolveTrustedServiceTokens({
+    nodeEnv: "development",
+    serviceToken: "service-token",
+    a2aAllowedKey: "a2a-token",
+  });
+  assert.equal(development.has("service-token"), true);
+  assert.equal(development.has("a2a-token"), true, "development must include configured A2A token");
+}
 
 console.log("user-profile: all assertions passed");