Spring Security 7.1 JWT authentication on Spring Boot 4.1

Runnable companion for https://ankurm.com/spring-security-7-1-jwt-authentication-guide/

- login -> token issue -> OncePerRequestFilter -> SecurityContext, end to end
- HS256 and RS256 variants (RS256 publishes a real JWKS endpoint)
- the same API secured by the built-in oauth2ResourceServer().jwt(), for comparison
- 11 documentation chapters under docs/, interlinked with the code
- docs/output/ is real captured output, regenerated by scripts/run-all.sh
- 13 passing tests pinning the 401-vs-403 contract and the CSRF failure

Verified against Spring Boot 4.1.1, Spring Security 7.1.1, JDK 25.0.4.1.

docs/output/resource-server-loose.txt

@@ -0,0 +1,63 @@
+==========================================================================
+ jwt-auth-demo - built-in resource server
+ profiles: hs256,resourceserver
+==========================================================================
+
+--------------------------------------------------------------------------
+# 1. The filter chain. Note BearerTokenAuthenticationFilter in place of our
+#    hand-written JwtAuthenticationFilter - same slot, framework-owned.
+
+HTTP 200
+[
+    {
+        "matchesThisRequest": true,
+        "filters": [
+            "DisableEncodeUrlFilter",
+            "WebAsyncManagerIntegrationFilter",
+            "SecurityContextHolderFilter",
+            "HeaderWriterFilter",
+            "LogoutFilter",
+            "OAuth2ProtectedResourceMetadataFilter",
+
+
+--------------------------------------------------------------------------
+# 2. Access token -> 200.
+
+HTTP 200
+{
+    "name": "alice",
+    "authorities": [
+        "FACTOR_BEARER",
+        "ROLE_USER",
+        "SCOPE_profile:read"
+    ],
+    "authenticationType": "JwtAuthenticationToken",
+    "jti": "5dc2e769-9413-44e4-9bcb-6ab9fe1f6b2e",
+    "issuer": "https://jwt-auth-demo.ankurm.com",
+
+
+--------------------------------------------------------------------------
+# 3. Non-admin on an admin route -> 403 insufficient_scope.
+
+HTTP 403
+WWW-Authenticate: Bearer error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token.", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"
+
+--------------------------------------------------------------------------
+# 4. REFRESH token presented as an access token.
+#    This is the line to watch when comparing the two runs.
+
+HTTP 200
+{
+    "name": "alice",
+    "authorities": [
+        "FACTOR_BEARER"
+    ],
+    "authenticationType": "JwtAuthenticationToken",
+    "jti": "8e069702-70a3-4029-89e8-d03c8b3e01ce",
+    "issuer": "https://jwt-auth-demo.ankurm.com",
+    "audience": [
+        "jwt-auth-demo-api"
+
+
+--------------------------------------------------------------------------
+# end