JWT and JWKS conformance tests for Supabase requirements

[pataniaeli]

Ticket: AUTH-T97 · Epic: E13 Testing & QA · Phase: Phase 2 — Admin, Primary Admin, positions, UI, SDK, VaultZ
Priority: Medium · Estimate: 2 points · Labels: epic:testing, phase:2, testing, jwt, supabase

Depends on:

• ES256 JWTs with JWKS and OIDC discovery for Supabase-backed products #41 — AUTH-T29 ES256 JWTs with JWKS and OIDC discovery for Supabase-backed products

Tests: token verifies with jose via remote JWKS; header has alg: ES256 and kid; claims include uuid sub, role: 'authenticated', iss, aud, exp - iat ≤ 600; discovery document is valid; rotation keeps the old key in the JWKS for the grace period; token endpoint rejects missing/revoked sessions.

Acceptance criteria

• Conformance suite green; a checklist in the Supabase guide references these tests.

_{Generated from the SGAuth design (docs/sgauth-design in SGAOperations/auth). SGAuth is built on Neon and does not use Supabase.}