Verify return-nav JWT signature; tidy token refresh

Shipped

July 8, 2026 at 12:42 AM UTC

Author

Kamo

Commit

6d21bfd

- CanvaJwtVerifier: verify the correlation_jwt's Ed25519 signature against Canva's JWKS (/connect/keys), plus aud/exp/type; keys cached by kid. Return-nav now fails closed to manual import if verification fails. - CanvaTokenService: drop the ineffective @Transactional on the self-invoked refresh/markDown helpers (Spring Data's per-call tx + the per-member lock already make token rotation correct); clarify with a comment.