[*] role=fixed  public_key=451 bytes
[*] create consumer RS256: 201
[*] create route jwt-auth: 201
[*] no-jwt: 401 (expect 401)
[*] forged HS256 JWT: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJrZXkiOiJqYWNrLWtleSJ9.rG2T5SBr...
[*] forged-jwt: 401  body={"message":"failed to verify jwt"}

[+] FIXED: forged HS256 JWT rejected (401) -> algorithm mismatch enforced