[spydon]

Fixes #1869. Fixes #1868 (duplicate).

get_claims() raised a raw pydantic ValidationError for tokens whose segments base64-decode but don't match JWTHeader or JWTPayload, so a malformed Authorization header became a 500 instead of a catchable AuthError.

Changes

• decode_jwt validates the header and payload inside the same try as the base64 decoding, and re-raises ValidationError as AuthInvalidJwtError("Invalid JWT structure").
• JWTHeader.typ is optional, since typ is optional per RFC 7515 §4.1.9 and a valid token without it was rejected.
• _fetch_jwks matches keys with jwk.get("kid"), so a JWKS containing keys without a kid (optional per RFC 7517) no longer raises KeyError.

Tests

• decode_jwt raises AuthInvalidJwtError for a non-JSON header or payload, alg: none, alg: EdDSA, a header that is a JSON array, and a string exp, and accepts a header without typ.
• Async and sync get_claims raise AuthInvalidJwtError for a malformed header, and _fetch_jwks skips supplied keys without a kid.
• The 11 new tests fail on main and pass with the fix. mypy and ruff pass.