pub fn validate_user(services: &Services, token: &str) -> Result<OwnedUserId>
Validates a login token and resolves its local user identity.
The configured JWT rules validate the token before its subject becomes a user ID.