You have just wired up an endpoint that expects a JWT in the Authorization header, and now comes the part nobody enjoys: proving it actually works. Not “it should work based on the code,” but watching a real request go out with a real token attached, and a real 200…

