fix(jwt): handle full Authorization: Bearer header line in decodeJwt

The page detected Authorization: Bearer input as JWT but decodeJwt only
stripped the Bearer scheme prefix, leaving the Authorization: field name
in the string — causing atob to throw on the first dot-segment. Strip the
header field name before the scheme prefix so the full header line round-trips
correctly.

Author: kellenmurphy

src/lib/jwt.test.ts

@@ -105,6 +105,12 @@ describe('decodeJwt — Bearer prefix', () => {
         const result = decodeJwt('bearer ' + RS256_FULL);
         expect(result.raw).toBe(RS256_FULL);
     });
+
+    it('strips full "Authorization: Bearer " HTTP header line', () => {
+        const result = decodeJwt('Authorization: Bearer ' + RS256_FULL);
+        expect(result.raw).toBe(RS256_FULL);
+        expect(result.header.alg).toBe('RS256');
+    });
 });
 
 describe('decodeJwt — alg:none', () => {

src/lib/jwt.ts

@@ -50,7 +50,7 @@ function parseScopes(payload: Record<string, unknown>): string[] | null {
 }
 
 export function decodeJwt(input: string): JwtDecodeResult {
-    const trimmed = input.trim().replace(/^Bearer\s+/i, '');
+    const trimmed = input.trim().replace(/^Authorization:\s+/i, '').replace(/^Bearer\s+/i, '');
     const parts = trimmed.split('.');
     if (parts.length !== 3)
         throw new Error('Invalid JWT: expected 3 dot-separated parts');