Auth & JWT

JWT validation-only — tokens issued by dazoapp. verifyToken middleware with IP allowlist bypass via x-forwarded-for (spoofable). Tenant authorization not enforced — store_id not matched to claims.