feat: add test connection button to JWT build feature

[matt-richardson]

Summary

• Adds a Test button to the JWT build feature configuration page
• Issues a dry-run JWT using the current feature settings and verifies the OIDC discovery/JWKS endpoints are reachable
• Optionally exchanges the JWT for an access token at a given service URL (HTTPS required; sends Content-Type: application/x-www-form-urlencoded per RFC 8693)

Test plan

• Configure a JWT build feature and click "Test" — should show step results inline
• Try with an invalid cron/service URL — should return a clear error
• Verify CSRF token is validated (reject requests without it)
• Verify non-admin users receive 403

🤖 Generated with Claude Code

[mattburnell]

Feature and tests look really good. Claude was bothered by what it sees as a moderate SSRS attack (by allowing non-https traffic for localhost URLs, anyone with MANAGE_SERVER_INSTALLATION can use the service to probe local HTTP endpoints). While the test logic looks thorough, I feel the readability could be substantially improved by encapsulating some of the setup/teardown logic into higher-order functions.

[matt-richardson]

Claude was bothered by what it sees as a moderate SSRS attack (by allowing non-https traffic for localhost URLs, anyone with MANAGE_SERVER_INSTALLATION can use the service to probe local HTTP endpoints).

I removed the support for isLocalHost, and switched the tests to use mocking instead.

While the test logic looks thorough, I feel the readability could be substantially improved by encapsulating some of the setup/teardown logic into higher-order functions.

Done. Removed ~200 lines from the PR 😄