fix(admin): restore AWS ALB SSO token verification

[benben]

Summary

• verify ES256 signatures using the JOSE fixed-width R || S encoding emitted by AWS ALB
• read ALB security metadata (exp, signer, iss, and client) from the protected JWT header
• make test tokens match the documented padded AWS ALB wire format while retaining forged-token rejection coverage
• document the verifier configuration and fail-closed defaults

Why

The verifier introduced in #1155 modeled signatures as ASN.1 DER and placed ALB metadata in the payload. AWS ALB emits a 64-byte JOSE ECDSA signature and puts that metadata in the protected header, so valid authenticated admin sessions were rejected.

The fix keeps the existing trust boundary: the signature, expiry, signer region, configured issuer, and configured client are checked before payload identity claims are accepted.

References:

• https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html#user-claims-encoding
• https://www.rfc-editor.org/rfc/rfc7518.html#section-3.4

Test plan

• Red: production-shaped ALB token fails with JWT signature verification failed before implementation
• Green: ALB verifier and auth middleware tests pass through just test-controlplane-k8s
• Added rejection coverage for ASN.1 and wrong-length signatures, payload-only metadata, expiry, signer region, issuer, client, wrong keys, and tampering
• Full just test-controlplane-k8s: local environment lacks docker-compose for unrelated PostgreSQL-backed admin tests
• just lint: local golangci-lint v2.12.2 reports unrelated existing findings outside the changed files

[github-actions]

Test Impact Plan

Deterministic summary of how this PR changes tests, CI runners, and coverage-risk signals.

Summary

Area	Added	Changed	Deleted
Test files	0	2	0
E2E/journey files	0	0	0
Workflow files	0	0	0

Signals

• Test cases: +0 / -0
• Assertions: +4 / -1
• Skips or known failures added: 0
• Workflow continue-on-error added: 0
• Workflow path filters added: 0
• Test commands removed from justfile: 0
• E2E/journey retry lines added: 0

Coverage risk: neutral or increased

No coverage-reduction warnings detected.