Harden Cloudflare Access authentication startup

[nihaopaul]

Summary

• prefer Cf-Access-Jwt-Assertion with CF_Authorization cookie fallback
• require the normalized Cloudflare team issuer and explicit exp, iss, and aud claims
• validate nbf and observe distinct validated token types without enforcing type == app yet
• fetch non-empty JWKS and the complete paginated application catalog before binding the listener
• retain last-known-good state after refresh failures and bound Cloudflare requests with timeouts and pagination limits
• add stable, rate-limited denial reason logging without exposing credentials, claims, identities, keys, or AUD lists
• document the startup guarantees and jsonwebtoken's 60-second expiration leeway

Compatibility

• retains match=any&ui_apps=true; catalog selection semantics are unchanged
• retains any_app authorization behavior
• does not enforce type == app; that remains gated on the seven-day observation window
• adds no new configuration

Validation

• cargo fmt --all --check
• cargo check --workspace --all-targets
• cargo clippy --workspace --all-targets -- -D warnings
• regression coverage for required claims, issuer, audience, expiration leeway, nbf, empty startup state, pagination, last-known-good refreshes, token-source precedence, generic 403 responses, and denial-log suppression summaries

Follow-up

After this release runs for seven days, review observed token types from every supported login flow before considering type == app enforcement in Piece 1b.