TUN-10801: Validate quick tunnel broker assertions

## Summary

Validates callback-bound Quick Tunnel broker assertions using the verification keys cached in !1937. The validator accepts only ES256 JWTs from the fixed broker issuer and audience, verifies signatures before claims, enforces the two-minute handoff lifetime and Access identity expiry, binds the callback hostname and browser state, validates and normalizes the verified email, and returns a trusted identity for recipient authorization.

The temporary hostname validator mirrors TUN-10800 and is documented for consolidation after that stack merges.

## Stack

- Depends on: !1937
- Part 2/2: this MR

## Validation

- `make test lint`
- focused `go test -race ./connection` coverage for JWT headers, signatures, claims, and identity binding