feat: add JWT extension (#369)

Author: balazsorban44

extensions/jwt/.github/assets/screenshot.png

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Balázs Orbán
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

extensions/jwt/LICENSE

@@ -0,0 +1,48 @@
+# JWT for Vicinae
+
+Decode a JSON Web Token from your clipboard and read it without leaving the keyboard.
+An extension for [Vicinae](https://vicinae.com).
+
+<img src=".github/assets/screenshot.png" alt="Decoded payload, signature verification and a diff between two tokens">
+
+## Features
+
+### Decode
+
+Takes the token from the clipboard, or as a command argument. Arrow keys move between
+sections, Enter acts on the one you are on.
+
+| Section | Enter | Shows |
+|---|---|---|
+| Payload | Copy JSON | Claims annotated with their registered names, timestamps as dates |
+| Header | Copy JSON | The JOSE header, annotated the same way |
+| Signature | Verify | The verdict, the algorithm, the issuer's discovery document |
+| Diff | Copy patch | A unified diff against the previously decoded token |
+| Specs | Open RFC 7519 | RFC 7519, RFC 7515, RFC 9068, OpenID Connect Core |
+
+### Expiry
+
+Reads the clipboard and shows a HUD:
+`Active - Aug 30, 2026, 2:52 AM - in 2 hours - web-app - 1234567890`.
+
+## Verifying
+
+Verification runs only when you ask for it, and only talks to the token's own issuer.
+
+* **RS, ES, PS**: the `iss` claim leads to the discovery document, then the JWKS, then
+  the key matching `kid`. Both requests must be https, and a redirect off https is
+  refused, since a tampered key set makes a forged token look verified.
+* **HS256/384/512**: a form asks for the shared secret. It is tried as raw text and as
+  base64url, the result says which matched, and it is never stored.
+
+## Install
+
+Open the Vicinae launcher, run **Store**, and search for JWT.
+
+## Source
+
+Developed at [balazsorban44/vicinae-jwt](https://github.com/balazsorban44/vicinae-jwt).
+
+## License
+
+MIT