Update aligned backend dependency packages

[Chris0Jeky]

Summary

• update the aligned Microsoft.IdentityModel.Tokens and System.IdentityModel.Tokens.Jwt packages from 8.19.2 to 8.21.0
• update Sentry.AspNetCore from 6.7.0 to 6.8.0
• update test-only FsCheck and FsCheck.Xunit from 3.3.3 to 3.3.4
• supersede deps(nuget): Bump the dotnet-minor-patch group with 5 updates #1527 with the same five-line package diff on current main, because the old shared merge commit lacked the repository's literal DCO trailer even though the advisory hosted check passed

The replacement head contains one signed commit and does not rewrite the Dependabot branch.

Verification

• dotnet build backend/Taskdeck.sln -c Release -m:1 — passed, 0 errors (11 existing warnings)
• dotnet test backend/Taskdeck.sln -c Release -m:1 --no-build — 7,551 passed / 5 intentionally skipped / 0 failed
• dotnet list backend/Taskdeck.sln package --vulnerable --include-transitive — no vulnerable packages reported
• node scripts/check-docs-governance.mjs
• node scripts/check-golden-principles.mjs
• node scripts/check-github-ops-governance.mjs
• git diff --check origin/main...HEAD
• Frontend typecheck/build/Vitest — not applicable; no frontend files or packages changed
• Playwright smoke/E2E — not applicable; no UI or cross-surface behavior changed

The full local run was performed on tree 29a611182f812579b254b8734b704a8d7bcd31d3. This PR's signed head has that exact tree.

Documentation

• docs/STATUS.md — no shipped behavior changed
• docs/IMPLEMENTATION_MASTERPLAN.md — no roadmap or priority changed
• docs/TESTING_GUIDE.md / docs/MANUAL_TEST_CHECKLIST.md — no verification flow changed

Tracking

• No product issue is closed; this is a history-clean replacement for deps(nuget): Bump the dotnet-minor-patch group with 5 updates #1527
• Project item is Review / Priority V (no linked issue, so the documented fallback applies)

CI Workflow Validation

• No workflow, deploy, script, or project file changed; ordinary required CI remains the hosted merge gate

Risk Notes

• Security impact: JWT validation libraries move together to preserve version alignment.
• Behavior/regression risk: low-to-moderate package-update risk, bounded by the full backend suite and vulnerability audit.
• Follow-up tasks: close deps(nuget): Bump the dotnet-minor-patch group with 5 updates #1527 as superseded after this replacement lands if Dependabot does not close it automatically.

[Chris0Jeky]

Independent exact-head review — clean

• Base: 3ee5a8bf9e2774fd39a70858a92b81ef648cde4a
• Head: 6a1eec90a2e9c1a7682806d7f4fccac588c2f654
• Tree: 29a611182f812579b254b8734b704a8d7bcd31d3
• Scope: only backend/Directory.Packages.props; five aligned version updates; git diff --check clean
• Findings: 0 CRITICAL / 0 HIGH / 0 MEDIUM / 0 LOW
• Resolution graph: IdentityModel core/JWT/JsonWebTokens/Logging/Abstractions resolve at 8.21.0; Sentry.AspNetCore/Extensions.Logging/core resolve at 6.8.0; FsCheck/FsCheck.Xunit resolve at 3.3.4
• Proportionate evidence: Release build plus full backend suite, 7,551 passed / 5 intentional skips / 0 failed

Residual risk is limited to live OIDC-provider and live Sentry-vendor roundtrips; neither integration surface changed, and Sentry remains default-off. Hosted exact-head CI, thread/comment triage, and the post-push eligibility floor still gate merge.