test(security): compute now fresh per-test in s2s-verify tests

Avoids clock-drift flakiness on the exact-skew-boundary assertions when
vitest's transform/import phase is slow under concurrent load (the
describe-block-level `now` could go stale by the time the test body ran).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: asachs01

src/__tests__/s2s-verify.test.ts

@@ -15,21 +15,25 @@ describe("verifyS2sHeader", () => {
   const MASTER = "test-master-secret-do-not-use-in-prod";
   const ownSubkey = deriveRecipientSubkey(MASTER, "ncentral");
   const siblingSubkey = deriveRecipientSubkey(MASTER, "saas-alerts");
-  const now = Math.floor(Date.now() / 1000);
 
   it("accepts a header minted with this vendor's own derived subkey", () => {
+    const now = Math.floor(Date.now() / 1000);
     expect(verifyS2sHeader(mintHeader(ownSubkey, now), ownSubkey)).toBe(true);
   });
   it("REJECTS a header minted for a different vendor's derived subkey (recipient-binding proof)", () => {
+    const now = Math.floor(Date.now() / 1000);
     expect(verifyS2sHeader(mintHeader(siblingSubkey, now), ownSubkey)).toBe(false);
   });
   it("rejects a stale timestamp outside the skew window", () => {
+    const now = Math.floor(Date.now() / 1000);
     expect(verifyS2sHeader(mintHeader(ownSubkey, now - 301), ownSubkey)).toBe(false);
   });
   it("rejects a future timestamp outside the skew window", () => {
+    const now = Math.floor(Date.now() / 1000);
     expect(verifyS2sHeader(mintHeader(ownSubkey, now + 301), ownSubkey)).toBe(false);
   });
   it("accepts a timestamp at the edge of the skew window", () => {
+    const now = Math.floor(Date.now() / 1000);
     expect(verifyS2sHeader(mintHeader(ownSubkey, now - 300), ownSubkey)).toBe(true);
   });
   it("rejects a malformed header value", () => {
@@ -39,9 +43,11 @@ describe("verifyS2sHeader", () => {
     expect(verifyS2sHeader(undefined, ownSubkey)).toBe(false);
   });
   it("rejects when the secret is empty (dark-by-default guarantee)", () => {
+    const now = Math.floor(Date.now() / 1000);
     expect(verifyS2sHeader(mintHeader(ownSubkey, now), "")).toBe(false);
   });
   it("rejects a tampered signature", () => {
+    const now = Math.floor(Date.now() / 1000);
     const header = mintHeader(ownSubkey, now);
     const tampered = header.slice(0, -1) + (header.endsWith("0") ? "1" : "0");
     expect(verifyS2sHeader(tampered, ownSubkey)).toBe(false);