pub fn current_sub() -> Option<String>
Get the JWT sub claim (stable user ID, e.g. Keycloak UUID). Returns None outside a request context or for non-JWT auth. Use for stable per-user keying (token store, etc.).
sub
None