- timing: rejection branches burn a constant bcrypt verify (no user
  enumeration oracle via response time)
- timezone.utc instead of datetime.UTC: requires-python >=3.10 is honest
  again (UTC alias is 3.11+, import would fail at runtime on 3.10)
- decode_token requires exp+sub claims (leaked secret must not mint
  eternal/anonymous tokens)
- weak HS256 secrets (<32 bytes) raise ValueError loud
- malformed stored bcrypt hash verifies False (401), not ValueError (500)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>