Allow jwt v3

[zackgp]

What?

Relax the jwt dependency constraint in the gemspec from >= 1.5.4, ~> 2 to
>= 1.5.4, < 4, so consumers can install jwt 3.x.

• Audited all usages of the jwt gem in this repo (JWT.encode /
  JWT.decode in Customer#login_token). Both calls use the classic
  positional API (HS256 algorithm, typ header), which is unchanged and
  fully supported in jwt 3.x — no breaking API usage was found.
• Added a regression test in customer_spec.rb covering
  CVE-2026-45363
  (fixed in jwt 3.2.0): JWT.decode must reject empty/nil HMAC keys instead
  of treating them as a valid signature. The test is scoped to run only when
  the resolved jwt version is >= 3.2.0, since the gemspec still allows
  jwt 2.x for backwards compatibility.

Tickets / Documentation

• ruby-jwt v3.0.0 CHANGELOG
• GHSA-c32j-vqhx-rx3x

Screenshots (if appropriate)

N/A