Customer Token Verification: JWKS Endpoint & Token Validation

🔍 Problem Statement

As a developer integrating Pelcro authentication, I have no way to verify a customer's token independently: Pelcro signs with HS256 and cannot share the secret, and there is no endpoint that reports whether an auth.token is valid, expired, or revoked. Every check therefore costs an API round-trip (100–500ms) or an indirect probe with an authenticated request.

💡 User Story

As a developer integrating Pelcro authentication, I want to verify customer tokens locally via a standard JWKS endpoint, and to confirm a specific token's validity via a dedicated validation endpoint, so that I can protect resources and manage sessions without extra authenticated calls.

🎯 Definition of Done (DoD)

• ✔ Given a client requests GET /.well-known/jwks.json, then a valid JWKS containing the RS256 public key(s) is returned in standard format.
• ✔ Given a JWT issued after deployment, when it is verified with the public key from the JWKS endpoint, then the signature validates without any further Pelcro API call — and newly issued tokens use RS256.
• ✔ Given an auth.token is posted to the token-validation endpoint, then the response states whether it is valid, expired, or invalid, without requiring a separate authenticated request.
• ✔ Given a JWT issued before deployment (HS256), when presented to authenticated endpoints, then it is still accepted until existing tokens expire.
• ✔ This change will impact API — specifically the authentication endpoints (Core API) and token issuance.
• ✔ Limitations: local verification confirms signature and expiry only; revocation still requires the validation endpoint.