Add decoder unit tests

[christiansamaniego-okta]

No description provided.

[github-actions]

Preview URL https://next-jwt-dh59osktd-okta-3f38a12f.vercel.app

[jonathanp-okta]

Assessment of #907:

• Test-only PR, no risk to production code.Verified locally: all 6 tests pass against current master.
• Fills a real gap — decoder service had zero unit tests before this.
• Caveat: coverage is partial — it exercises the "empty token," "invalid format," "unsecured JWT," and HMAC valid/invalid paths, but not the digital-signature (RS/ES) branch or the public-key-download-failure paths in handleJwtChange. Not a blocker, just worth a review comment.
• It's "Awaiting approval" with no reviews yet — that's the only thing blocking merge, not code quality.