fix: wrap SyntaxError as JsonWebTokenError for malformed payloads

[abhu85]

Summary

Wrap SyntaxError from malformed JWT payloads as JsonWebTokenError for consistent error handling.

Problem

When jwt.verify() encounters a token with an invalid JSON payload, it throws a raw SyntaxError instead of a JsonWebTokenError with message "jwt malformed". This is inconsistent with the documented error types and forces consumers to catch multiple error types.

Solution

Wrap the JSON.parse() call for the JWT payload in a try/catch block. When a SyntaxError is caught, re-throw as new JsonWebTokenError('jwt malformed').

Test Plan

• Malformed JSON payload throws JsonWebTokenError (not SyntaxError)
• Error message is "jwt malformed"
• Valid tokens still verify correctly
• Existing test suite passes

Fixes #591
Fixes #652