Decode a JWT (JSON Web Token): returns the header, payload and the extracted claims (subject sub, issuer iss, audience aud, expiration exp with `expired` flag and seconds remaining, issued-at iat, ...

Decode a JWT (JSON Web Token): returns the header, payload and the extracted claims (subject sub, issuer iss, audience aud, expiration exp with `expired` flag and seconds remaining, issued-at iat, not-before nbf, algorithm alg, key id kid). Decode-only — the signature is NOT verified, so claims are informational. Pass the token via ?token=<jwt> (query param, no length limit).