Covers missing / malformed / forged / blacklisted / unregistered / valid JWT cases for the JWT-only identity route that replaces the bare-pubkey auto-restore path. Route does not exist yet — 6/7 fail as expected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>