Validate Model Target JWT signatures

[adamtheturtle]

Summary

• reject empty and malformed base64url JWT signature segments with Vuforia-compatible 401 responses
• add verified-fake cases that run against real Vuforia and both mock backends
• update mock bearer-token fixtures, documentation, and the changelog fragment for the stricter syntax

Why

The Model Target mock already validated JWT header and payload segments, but accepted any signature segment, including an empty or malformed one. Real Vuforia distinguishes these cases and returns stable error messages, so matching them improves authentication fidelity toward #3192.

Impact

Callers using malformed Model Target bearer tokens now receive the same observable errors as real Vuforia. The mock still does not cryptographically verify signatures or payload claims.

Root cause

Bearer-token validation returned after checking only JWT structure, header, and payload. The signature segment was never decoded or checked for emptiness.

Validation

• uv run pytest -q tests/mock_vws/test_model_target_web_api.py::TestAuthentication::test_invalid_bearer_token tests/mock_vws/test_model_target_generation_failure.py tests/mock_vws/test_model_target_generation_warning.py tests/mock_vws/test_requests_mock_usage.py::TestModelTargetWebAPI tests/mock_vws/test_respx_mock_usage.py::TestModelTargetWebAPI (44 passed, including live Vuforia)
• uv run pytest -q tests/mock_vws/test_model_target_web_api.py --skip-real tests/mock_vws/test_model_target_generation_failure.py tests/mock_vws/test_model_target_generation_warning.py tests/mock_vws/test_requests_mock_usage.py::TestModelTargetWebAPI tests/mock_vws/test_respx_mock_usage.py::TestModelTargetWebAPI (82 passed, 32 skipped)
• uv run prek run --all-files
• pre-push type and manifest checks