F-0002 PoC — Rogue JWKS Server

This server demonstrates CWE-918 — host header SSRF leading to full authentication bypass in @infinitaslearning/auth-first-party-core.

JWKS endpoint: /identity/.well-known/openid-configuration/jwks