Fix/json body limit and jwt exp validation

[Litezy]

Closes #826
Closes #827

Summary

• Set an explicit 1mb limit on express.json() in app.ts — documents
  intent and caps the JSON-parse DoS surface (was silently defaulting to 100 kb).
• Guard payload.exp in verifyJwt with a typeof check before the
  numeric comparison — previously a signature-valid token with no exp field
  evaluated undefined < number → false and was accepted forever.