Raised when an id_token JWT can’t be verified — bad signature, wrong issuer/audience, expired, or nonce mismatch.