fix(auth): reject malformed JWT payloads without throwing

[pandemicsyn]

Summary

Malformed bearer tokens with invalid JSON payloads can throw during runtime-proof inspection, causing gateway requests to fail with an unhandled exception. Catch decoding failures and return the existing 401 authentication response without logging the token.

Fixes KILOCODE-WEB-27VB. Valid-token verification and runtime-proof requirements are unchanged. This hotfix targets main independently of the remaining token rollout PRs.

Verification

Reproduced the decoder exception locally with a synthetic malformed JWT. No live-environment manual test was performed.

Automated checks

• Both new malformed-payload regression cases failed against the original code, then passed with the fix. Tests also cover mixed-case Bearer headers, malformed JSON headers, and no session fallback.
• 228 tests passed across authentication, token validation, gateway audience integration, and gateway request handling.
• Web typecheck, changed-file lint, formatting, and git diff --check passed.

Visual Changes

N/A

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/web/src/lib/user/server.ts
• apps/web/src/lib/user/server.test.ts

---

_{Reviewed by grok-4.6 · Input: 79.2K · Output: 6.3K · Cached: 159.9K}

_{Review guidance: REVIEW.md from base branch main}