Enforce an explicit authorization policy for cloud-init admin APIs #145

#144 requires JWT authentication for /admin/ routes, but verification currently checks signatures and the presence of sub, iss, and aud. It does not enforce expected issuer or audience values, require expiration, or distinguish administrative tokens from ordinary-user tokens.

If the configured JWKS contains signing keys shared with other services or users, their tokens can authorize all enabled administrative operations, including configuration writes and impersonation. Deployments currently need signing keys and issuance policies dedicated to administrative authority.

Follow-up to the authorization policy review comment.

Implement an explicit admin authorization policy that:

• Validates configured expected issuer and audience values.
• Requires an expiration claim and validates token time constraints.
• Defines and enforces the role, scope, or other claim that grants administrative authority.
• Fails closed when required policy configuration is missing or invalid.
• Preserves tokenless node bootstrap behavior.

Acceptance criteria:

• Valid administrative tokens can access enabled admin operations.
• Correctly signed tokens for another issuer or audience are rejected.
• Tokens without expiration, expired tokens, and tokens that are not yet valid are rejected.
• Ordinary-user tokens without the required administrative authority are rejected.
• Rejected requests cannot mutate stored configuration or access impersonation.
• Tests cover the production JWKS verification path and shared signing keys.
• Operator documentation explains configuration, token requirements, migration, and failure responses.