Decode JWT headers and payloads, inspect timing claims, and verify signatures locally