JWT Decode Pipeline: display claims, then validate separately

Decoding is not verification. A plausible header and payload can be forged by anyone, and a live JWT may be a bearer credential, so do not send it to an untrusted decoder or store it in logs. Parse Base64url safely, allowlist the expected signing algorithm, select keys from a trusted issuer, verify the signature, and then validate exp, nbf, iss and aud with a small deliberate clock tolerance. Reject unsecured tokens and unexpected key identifiers. Pretty printing belongs after verification when the token drives a security decision.