v1.2.0 — JWKS rotation resilience

- CachingJwks (JwksSource): TTL cache + refresh-on-unknown-kid + serve-stale + anti-storm backoff — survives auth-server signing-key rotation without a restart
- verify() accepts JwksSource (source-compatible; Jwks implements it)
- require exp (aligns with the Go verifier; rejects non-conformant tokens)