Port jsonwebtoken issued-at and maxAge semantics

Scope

Port Bun corpus position 4006, js/third_party/jsonwebtoken/claim-iat.test.js.

Acceptance criteria

• Signing validates explicit iat claims, adds the current timestamp by default, and removes it under noTimestamp.
• Existing finite and non-finite number behavior matches the copied upstream corpus exactly.
• Verification validates iat when maxAge is present and supports numeric/timespan max ages, clock timestamps, and clock tolerance.
• Max-age failures preserve the concrete JWT error type, expiredAt, claim/operation metadata, original cause, and operation-aware cause stacks.
• String payloads remain unmodified.
• Focused, adjacent JWT, and permanent diagnostic suites pass.

Completed in d728c149c and pushed to main.

Home now passes all 39/39 assertions in Bun corpus position 4006, js/third_party/jsonwebtoken/claim-iat.test.js. Signing validates explicit iat, defaults it from the active clock, preserves upstream non-finite-number serialization behavior, removes it under noTimestamp, and leaves string payloads unchanged. Verification supports numeric and string maxAge, clockTimestamp, and clockTolerance.

The error model was also corrected structurally: TokenExpiredError now inherits from JsonWebTokenError. Max-age failures retain ERR_JWT_VERIFY, claim iat, operation jsonwebtoken.verify, expiredAt, the original cause, and operation/cause stack frames.

Verification:

• focused issued-at file: 39 passed, 0 failed, 0 todo, 0 unsupported
• adjacent audience + expiration + issued-at files: 157/157
• permanent third-party diagnostic contracts: 6/6
• full third-party JWT/utility mini-suite: passed
• formatting and diff checks: passed