fix: Lazy-load JWKS in JWT validator + add unit tests

Changes:
- Make JWT validator lazy-load JWKS on first use (not on init)
- Thread-safe JWKS loading with mutex
- Fixes test failures (JWKS 404 was panicking on NewValidator)
- Add unit tests for JWT validation logic

Tests now pass:
  ✅ Check permissions (sqs:read, sqs:write, wildcard)
  ✅ Reject empty/invalid/malformed tokens
  ✅ Handle missing permissions claim

All 100% passing with no external dependencies.

internal/auth/jwt_test.go

@@ -0,0 +1,76 @@
+package auth
+
+import (
+	"testing"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+func TestCheckPermissions(t *testing.T) {
+	validator := NewValidator(
+		"https://authentik.riotpiao.com/application/o/sqs/",
+		"sqs",
+		"https://authentik.riotpiao.com/application/o/sqs/jwks/",
+	)
+
+	// Test 1: Finds sqs:read
+	claims1 := jwt.MapClaims{
+		"permissions": []interface{}{"sqs:read", "memory:write"},
+	}
+	if !validator.CheckPermissions(claims1, "sqs:read", "sqs:write") {
+		t.Fatal("expected to find sqs:read permission")
+	}
+
+	// Test 2: Finds wildcard
+	claims2 := jwt.MapClaims{
+		"permissions": []interface{}{"*"},
+	}
+	if !validator.CheckPermissions(claims2, "sqs:read") {
+		t.Fatal("expected to find wildcard permission")
+	}
+
+	// Test 3: Rejects when missing
+	claims3 := jwt.MapClaims{
+		"permissions": []interface{}{"memory:read"},
+	}
+	if validator.CheckPermissions(claims3, "sqs:read") {
+		t.Fatal("expected to reject missing permission")
+	}
+
+	// Test 4: Handles missing permissions claim
+	claims4 := jwt.MapClaims{}
+	if validator.CheckPermissions(claims4, "sqs:read") {
+		t.Fatal("expected to reject missing permissions claim")
+	}
+
+	t.Log("✅ All permission checks passed")
+}
+
+func TestValidateBearerToken(t *testing.T) {
+	validator := NewValidator(
+		"https://authentik.riotpiao.com/application/o/sqs/",
+		"sqs",
+		"https://authentik.riotpiao.com/application/o/sqs/jwks/",
+	)
+
+	// Test 1: Empty token
+	_, err := validator.ValidateBearerToken("")
+	if err == nil {
+		t.Fatal("expected error for empty token")
+	}
+	t.Logf("✅ Correctly rejected empty token: %v", err)
+
+	// Test 2: Invalid format
+	_, err = validator.ValidateBearerToken("not-a-bearer-token")
+	if err == nil {
+		t.Fatal("expected error for invalid format")
+	}
+	t.Logf("✅ Correctly rejected invalid format: %v", err)
+
+	// Test 3: Invalid token payload
+	_, err = validator.ValidateBearerToken("Bearer invalid.token.format")
+	if err == nil {
+		t.Fatal("expected error for invalid token")
+	}
+	t.Logf("✅ Correctly rejected invalid token: %v", err)
+}