Three JWT bugs that ship to prod silently — and the 5-line CI test that catches them

Your auth tests pass. Your token verification works. Then your identity provider rotates a key at 02:47, your service hasn't refreshed its JWKS cache for 12 hours, and 8 minutes of production traffic hits 401. Or worse: the rotation does happen, your cache picks up the new keys, but a service you ha