Configuration for the GET /auth/me session-identity endpoint.
Exposed at /auth/me when enabled. The endpoint reads the validated
JWT already in the request context and returns a JSON object containing
sub, user_id (alias for sub), expires_at, plus any extra claims
listed in expose_claims that are present in the token.
Raw JWT claim names to include in the response body, beyond the
always-present sub, user_id, and expires_at.
Names must match the raw claim key in the token (e.g. "email",
"https://myapp.com/role"). Claims absent from the token are silently
omitted. The user_id alias for sub is always included and must
not be listed here — listing "user_id" would silently return
nothing because the JWT only carries sub.