Security: Pin JWT signing algorithm to prevent algorithm confusion attacks

## Problem

JWT validation checks for `*jwt.SigningMethodHMAC` type but doesn't verify the specific algorithm (HS256 vs HS384 vs HS512). This could allow algorithm confusion attacks.

## Fix
Add explicit algorithm verification:
```go
if token.Method.Alg() != "HS256" {
    return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
}
```