ca0c774ec9
Replace the hardcoded token prefix validation with OAuth 2.0 Token Introspection (RFC 7662). The server now: - Discovers the introspection endpoint from AS metadata - Calls the introspection endpoint to validate each token - Extracts client_id, scopes, and expiry from the response This properly integrates with the authorization server rather than relying on hardcoded token patterns.