docs: note JWT revocation-aware userinfo behavior

Update integration guidance that revoked JWT access tokens are now rejected on provider userinfo before natural expiry.

README.md

@@ -131,6 +131,7 @@ This wrapper now delegates to `BlackWall\Auth\AuthClient`.
 - Handle provider callback errors (`error`, `error_description`) explicitly; treat `access_denied` as an expected user/authorisation outcome rather than a transport failure.
 - Expect `access_denied` even after the consent page is displayed if provider-side project membership or tenant scope changes before consent submission.
 - Expect provider token introspection to return `active=false` when user/project/client state is no longer active.
+- Expect revoked JWT access tokens to be rejected by provider `userinfo` even before token expiry.
 - Register only HTTPS redirect URIs in provider client settings (HTTP should be used only for localhost loopback during development).
 - Use OAuth/portal authentication endpoints for end users; provider admin login endpoints enforce separate admin scope checks.
 - For provider admin enrollment URL export operations, use `POST` with CSRF protection; do not automate them via unauthenticated `GET` links.

docs/INTEGRATION_GUIDE.md

@@ -137,6 +137,7 @@ try {
 `UserInfoException` with `invalid_token` can occur when provider-side subject scope is no longer active (for example user/project disabled) between token issuance and userinfo retrieval.
 `TokenExchangeException` with `invalid_grant` can also occur when provider-side client/user/project state is inactive at exchange time.
 Token introspection can return `active=false` when the token subject (user/project) or client has since been disabled.
+Provider JWT access tokens are now revocation-aware at `userinfo`; revoked JWTs can fail before natural expiry.
 Provider login/authorization steps can also fail with `access_denied` when account status is disabled before completion.
 WebAuthn-based login verification can return credential-style failures for disabled accounts even when authenticator assertions are otherwise valid.
 Existing authenticated sessions may also be invalidated when account status changes to disabled.