fix: add 30s leeway for clock skew, update expired token test

jwt.decode now tolerates 30s clock drift between servers.
Expired token test updated: -10s was within leeway, now -60s.

281 tests pass.

Author: DevanshuNEU

backend/services/auth.py

@@ -53,6 +53,7 @@ def _verify_local(self, token: str) -> Dict[str, Any]:
                 self.jwt_secret,
                 algorithms=["HS256"],
                 audience="authenticated",
+                leeway=30,
             )
 
             user_id = payload.get("sub")

backend/tests/test_jwt_local_decode.py

@@ -51,7 +51,7 @@ def test_bearer_prefix_stripped(self, auth_service):
         assert result["user_id"] == "user-456"
 
     def test_expired_token_raises_401(self, auth_service):
-        token = _make_token({"sub": "user-789", "exp": int(time.time()) - 10})
+        token = _make_token({"sub": "user-789", "exp": int(time.time()) - 60})
 
         from fastapi import HTTPException
         with pytest.raises(HTTPException) as exc: