Tailnet identity to short-lived JWT. Generic core with no dependencies,
Tailscale adapter in a nested module, identity-aware proxy, verifier
with remote JWKS.

Validated end to end against a live tailnet. The one assumption not yet
measured: that a hostile peer cannot change what the identity source
reports about it.