protection: bearer JWT (validated in app via JWKS)
Call GET /api/status with header Authorization: Bearer <access_token>.
Issuer: https://auth.rust-infra.de/application/o/auth-jwt-api-demo/
JWKS: https://auth.rust-infra.de/application/o/auth-jwt-api-demo/jwks/