JWT Payload for merchant authorization as per AP2 specification
iss: string
Issuer - identifier for the merchant
sub: string
Subject - identifier for the merchant (same as iss for merchant auth)
aud: string
Audience - intended recipient (e.g., payment processor)
iat: number
Issued at timestamp
exp: number
Expiration timestamp (short-lived, 5-15 minutes)
jti: string
JWT ID - unique identifier to prevent replay attacks
cart_hash: string
Secure hash of the CartMandate for integrity verification