The endpoint pipeline ran a SECOND JWT validation to answer a question the edge
had already answered one middleware earlier — a second crypto library, a second
JWKS URL, and ALL-of audience semantics against the edge's ANY-of, which 401s
every user JWT IAM issues. Requiring a credential and verifying one are
different jobs; only the second needs a key, and only one thing should do it.
Routes now declare `auth/public` and the edge is the one validator.
The ingress binary, its config and its manifests leave this repo. They were a
second copy of a service that has its own, and the two had drifted.
zeekay
cbc3c31192