Security & Identity Layer (Cross-Cutting)
JWT validation