[Improvement]: Add a config option to disable JWT signature validation in internal_token mode

Please select the area the issue is related to

Platform API

Please select the aspect the issue is related to

Aspect/API (API backends, definitions, contracts, interfaces, OpenAPI)

Suggested Improvement

Problem

In internal_token auth mode, JWT signature validation is always on and cannot
be turned off. There is no configuration to accept a token without verifying its
signature, even in deployments where verification is intentionally not wanted.

Request

Add an auth.jwt.skip_validation boolean config option. When enabled in
internal_token mode, the platform API should parse the token for its claims but
skip signature and issuer verification (so no public key is required), while still
requiring the organization claim.

Notes

• Must default to false — validation stays strict unless explicitly disabled.
• Must be ignored in file and idp modes.
• The option is dangerous on an internet-facing listener, so it should log a loud
  warning at startup when enabled and be clearly documented as such.

Related Issues

No response

Start by locating the Platform API's internal_token authentication path and configuration handling, then trace how JWT claims and verification differ across internal_token, file, and idp modes. Done means the option defaults to false, affects only internal_token mode, preserves the organization claim requirement, avoids requiring a public key when enabled, emits a loud startup warning, and is documented as unsafe for internet-facing listeners.