Match a JWT kid against a JWKS locally and diagnose duplicate kids, stale rotation, and alg or kty mismatches.