fix(server): upgrade jsonwebtoken 9 -> 11 (JEF-595)

[thejefflarson]

Summary

• Bumps jsonwebtoken from 9 to 11 (server/Cargo.toml + Cargo.lock). Dependabot chore(deps): bump jsonwebtoken from 9.3.1 to 11.0.0 in /server #129 had stalled on the jump to v10, which added a required explicit crypto-backend feature choice and broke the build unattended.
• Chose the rust_crypto backend (pure-Rust) over the alternative aws_lc_rs/native backends specifically to preserve the arm64 cross-compile for the Raspberry Pi image without introducing a system OpenSSL/AWS-LC toolchain dependency into the Docker cross-build.
• No source changes were needed in access_jwt.rs beyond the manifest bump — the v11 decode/Validation/DecodingKey API is unchanged from v9's usage here. Validation semantics are byte-identical: RS256-only allowlist (Validation::new(Algorithm::RS256)), set_issuer/set_audience/set_required_spec_claims(["exp","aud","iss"]), and the fail-open JWKS-unavailable path are all untouched.
• Added one new unit test, wrong_algorithm_rejected, covering the classic alg-confusion attack (signing with HS256 against a verifier that only allowlists RS256) — joins the existing valid/expired/wrong-aud/wrong-iss/tampered-signature/unknown-kid/cold-cache coverage in the same file.

Advisory note

The jsonwebtoken advisory this closes is MEDIUM severity (patched in 10.3.0, superseded here by 11). GitHub's push output on this branch shows the repo's remaining Dependabot findings as 1 HIGH + 1 MODERATE — the HIGH is react-router (GHSA-qwww-vcr4-c8h2, UI dependency), unrelated to this change and tracked as a separate follow-up, not touched in this PR.

Test plan

• cargo fmt — clean, no diff
• cargo check — clean
• cargo clippy --all-targets -- -D warnings — clean, zero warnings
• cargo test --locked — 69 unit tests + 66 integration tests, 0 failed. All access_jwt JWT-verification unit tests ran and passed (no DB needed): valid_token_passes, wrong_audience_rejected, wrong_issuer_rejected, expired_token_rejected, tampered_signature_rejected, wrong_algorithm_rejected (new), unknown_kid_rejected, garbage_token_rejected, cold_cache_with_dead_jwks_is_unavailable.
• Note: local Docker wasn't running for this run, so the Postgres-backed smoke/integration tests short-circuit via their pool_or_skip guard (reported as passing, since the test fn returns early) rather than exercising the DB — CI's server required check runs the full suite against a Postgres sidecar.
• Ran /soundcheck:pr-review on the diff: 0 Critical/High findings (dependency bump + one new test, no new attack surface, no relaxed validation).
• Ran /simplify on the changed files: already clean, no changes needed (new test mirrors the existing pattern in the file exactly).

Closes JEF-595
Supersedes dependabot#129

🤖 Generated with Claude Code