e50be99374
Better Auth signs access tokens with EdDSA (Ed25519), not RS256. Accept EdDSA (+ RS256/ES256), and validate issuer + signature + expiry strictly while checking audience softly — single-resource server behind a dedicated AS with dynamic DCR client ids, so issuer + signature is the trust boundary. Adds an EdDSA test.