fix(build): finalize ephemeral key options

backend/Program.cs

@@ -13,10 +13,6 @@ if (isOpenApiGeneration)
     // auth services, so use an ephemeral contract-only signing value.
     builder.Configuration["Jwt:Key"] =
         "openapi-contract-generation-only-000000000000000000";
-    builder.Services.AddDataProtection()
-        .UseEphemeralDataProtectionProvider();
-    builder.Services.Configure<KeyManagementOptions>(options =>
-        options.AutoGenerateKeys = false);
 }
 
 // --- Service Registration ---
@@ -34,6 +30,16 @@ builder.Services.AddNexusHealthChecks(builder.Configuration);
 builder.Services.AddNexusPlatform(builder.Configuration);
 builder.Services.AddControllers(options =>
     options.Filters.Add<NexusProblemDetailsFilter>());
+if (isOpenApiGeneration)
+{
+    // Apply this after every framework service has registered its defaults.
+    // The contract host never accepts traffic and must not persist runtime
+    // key material as a side effect of schema extraction.
+    builder.Services.AddDataProtection()
+        .UseEphemeralDataProtectionProvider();
+    builder.Services.PostConfigure<KeyManagementOptions>(options =>
+        options.AutoGenerateKeys = false);
+}
 
 var app = builder.Build();