fix: validate JWT introspection response to check "active" flag

[UnnikrishnanBhargavakurup]

Ensures that the OAuth 2.0 token introspection response includes "active": true. Prevents expired, revoked, or invalid tokens from being accepted.

#52

[dickhardt]

Thanks for this, and for the clear RFC 7662 write-up in #52 — the report was correct at the time.

Closing as obsolete rather than merging, because the code this patches no longer exists. Commit 0f6bff4 (2026-07-16, "api: OPC draft-02 command support with JWKS token verification") rewrote verifyCommandToken in api/src/handlers/command.ts. It no longer calls a token introspection endpoint at all — it decodes the protected header, checks typ, resolves iss against the configured command issuers, and verifies the token locally with jwtVerify against the issuer's JWKS, with issuer, audience, typ and requiredClaims all enforced. Expiry is enforced by jwtVerify itself.

git grep -i introspect over api/src on main now returns nothing, so there is no introspection response left to check active on. That is also why the PR shows as conflicting.

Closing #52 alongside this with the same pointer.