struct Value jwt_verify(const &char token, const &char secret, ?&int ok)Verifies 'token's signature against 'secret' and that its header says HS256. Does NOT check 'exp'/'nbf'/etc. itself (claims validation is left to the caller — read them back from the returned Value, e.g. 'claims->object_get("exp")') — only the cryptographic signature and JWT structure (three base64url segments) are checked here. *ok is set to 0 (result is VAL_NULL) on a malformed token or signature mismatch; on success, returns the decoded payload Value (caller owns it — call .free() on it).