Entra Token Verification

Tier: spec anchored to live code (second consumer adapted the original — the invariants below are the value, not a shared package; regenerate the implementation per consumer, per CONTRIBUTING.md).

Verifying an Entra access token server-side (via jose + the tenant JWKS endpoint) is easy to get subtly, silently wrong: a misconfigured issuer/audience check passes v1 tokens that should be rejected, or a verifier that never checks for scp/roles accepts an ID token as if it were an access token. These are the constraints that keep recurring across consumers — freeze them, regenerate the verification code itself.

The constraints