Options forwarded to JwtResolver.
Security note: the resolver reads the tenant id from an UNVERIFIED JWT
claim — a client can mint a token naming any tenant. Acceptable only
alongside authentication middleware which separately verifies the token.
A register() warning fires when the resolved chain contains a
JwtResolver.