Test with actual JWT from Authentik (poimen-memory app):
- ✅ Decodes real Authentik JWT
- ✅ Validates signature against Authentik JWKS
- ✅ Verifies claims (iss, aud, sub)
- ✅ Correctly rejects tokens with wrong audience
Token from: https://authentik.riotpiao.com
Issuer: https://authentik.riotpiao.com/application/o/poimen-memory/
Audience: poimen-memory
Algorithm: RS256 (signed by Authentik)
Proves JWT validation works with real Authentik tokens.
For SQS: Need to create SQS OAuth2 app in Authentik and grant
homelab-admin user SQS permissions.