docs: handle userinfo invalid_token outcomes in callback example

Update SDK example callback and integration guidance to treat UserInfoException as an authorization-state outcome (e.g. subject disabled/inactive scope) and return a clear 403 path.

docs/INTEGRATION_GUIDE.md

@@ -134,6 +134,8 @@ try {
 }
 ```
 
+`UserInfoException` with `invalid_token` can occur when provider-side subject scope is no longer active (for example user/project disabled) between token issuance and userinfo retrieval.
+
 ## Operational guidance
 
 - Keep provider URLs in environment variables, not hard-coded.

public_html/callback.php

@@ -16,6 +16,7 @@ foreach ($autoloadCandidates as $file) {
 }
 
 use BlackWallSDK\BlackWallAuth;
+use BlackWall\Auth\Exception\UserInfoException;
 
 $auth = new BlackWallAuth([
     'clientId' => '94d228c4-d4c6-4479-9b02-793e6a73e3f2',
@@ -42,6 +43,9 @@ try {
 
     header('Location: /');
     exit;
+} catch (UserInfoException $e) {
+    http_response_code(403);
+    echo 'User info access failed: ' . htmlspecialchars($e->getMessage(), ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
 } catch (Throwable $e) {
     http_response_code(500);
     echo 'Auth failed: ' . htmlspecialchars($e->getMessage(), ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');