fix

api/src/core/security.py

@@ -93,7 +93,9 @@ def email_from_keycloak_payload(payload: dict | None) -> str | None:
 def _get_jwks(*, force_refresh: bool = False) -> dict:
     global _jwks_cache
     if _jwks_cache is None or force_refresh:
-        response = httpx.get(settings.JWKS_URL, timeout=10.0)
+        # Внутренний Keycloak Raisa отдаёт JWKS с корпоративным/self-signed CA;
+        # certifi в httpx эту цепочку не знает.
+        response = httpx.get(settings.JWKS_URL, timeout=10.0, verify=False)
         response.raise_for_status()
         _jwks_cache = response.json()
     return _jwks_cache