Generate an HS256-signed JWT from payload claims and a shared secret. Optionally set iat and exp automatically for common lifetimes.

Signing uses the Web Crypto API locally — your secret never leaves the browser.