Missing, malformed, expired, not-yet-valid and incorrectly signed JWTs now return AuthenticationError with BusinessCode 401 and GraphQL extensions.code=401. Public messages omit JWT contents and validation details; Unwrap preserves the original JWT error. Header/cookie precedence and successful authentication remain unchanged. Access-checker permission and infrastructure errors pass through unchanged. Validation: go test -race ./..., go vet ./... and git diff --check passed. A local integration probe using the existing playlist-service middleware confirmed warning/401 plus GraphQL code 401 for token rejections, successful valid-token requests and error/500 for an infrastructure failure. No dependency versions or deployments changed; consumers need a new rbac release.