JWT Decoder + Signature Checker

Decode header & payload, verify HS256 with a shared secret. Flags alg: none and weak secrets.