OptionalclockOptionalisOptionalnowOptionalprincipalMap verified claims to a Principal. Default: a fresh anonymous
per-connection userId (the real identity lives in awareness) with the
token's role, expiry, and { jti, room } audit metadata.
Deny-list check for revoked
jtis ("revoke this link").