D1: Update CoreSync to validate our JWTs

## Summary
Update the CoreSync (Web) server to validate JWTs issued by our Identity system.

## Tasks
- Same JWT validation as API (shared signing key)
- Remove Microsoft.Identity.Web dependency
- Keep DevAuthHandler for dev mode

## Depends on: A2