Validate JWT and issue session token

Validates JWT from auth server and issues session token.

JWT Validation (security-critical order):

1. Signature verification (ECDSA P-256)
2. Audience check (must match device serial number)
3. POH expiration check (exp_poh vs current POH)
4. Nonce validation (single-use, must be pending)

Token Usage Types:

• cookie: Sets HTTP-only cookie, returns success message
• bearer: Returns session token in body, no cookie set

Security Properties:

• All validation failures return HTTP 401 with no information leakage
• Nonce marked as used after successful validation
• Session tokens expire based on POH, not wall-clock time
• Cookie security: http_only=True, same_site='Strict', secure=True (HTTPS)