(improve): classify Access JWT failures

[kyeunga25]

Summary

• keep Access verification fail closed while distinguishing expired, audience, issuer, and signature failures
• show a dedicated bilingual recovery message for each safe failure category
• avoid logging or returning JWTs, claims, identities, or deployment values
• add regression coverage for claim, lifetime, and signature validation

Verification

• npm run check
• npm test (68 tests)
• npm run build
• npm audit --audit-level=high
• npm run cf:dry-run
• npm run release:check
• git diff --check