JWT Authentication

Run a PortSwigger-style JWT room: verify, forge alg:none, tamper claims, expire, refresh — then lock the correct server check.

This room unlocks when you enrol in a linked course or have a matching Learn plan. No separate lab checkout — practice stays inside the track.