Expired or invalid JWT gets error_description "No token validation method configured" #262

When JWKS validation is configured and the token is expired or its signature is bad, TokenValidator.validateToken (src/auth/token-validator.ts) swallows the JWT error. Without an introspection endpoint it falls through to the generic message, so the challenge reads:

WWW-Authenticate: Bearer ..., error="invalid_token", error_description="No token validation method configured"

That is misleading for both clients and operators: a validation method is configured, the token just failed it.

Repro

Configure tokenValidation.jwksUri, send createExpiredJWT() from the test utils → 401 with the description above.

Suggested fix

Keep the JWT failure reason (e.g. "Token expired", "Invalid token signature", sanitized) and only use "No token validation method configured" when neither JWKS nor introspection is set.

Found during the round-7 review of #170; also on main.

🤖 Generated with Claude Code