chore: fix unrelated ci failures

[hweihwang]

Summary

• update firebase/php-jwt to v7 so static analysis can install cleanly with the current roave/security-advisories constraint
• add a focused JWTService unit test that covers valid encode/decode flow and invalid token rejection
• fix the Playwright test environment for php-jwt v7 by using a real-length shared secret for both the app config and the websocket server, which stops /apps/whiteboard/<id>/token from failing at runtime
• split the Playwright matrix into 3 shards and stop collecting full CI traces/videos for every passing test
• relax the multinode sync-reassignment wait that timed out on this PR under CI load

Verification

• composer require --dev roave/security-advisories:dev-latest --dry-run
• composer run psalm -- --threads=1 --monochrome --no-progress --output-format=console
• php -r 'require "vendor/autoload.php"; echo \Firebase\JWT\JWT::encode(["x"=>1], "test-secret-key-with-at-least-32-bytes", "HS256");'
• pnpm -s vitest run tests/integration/multinode-redis.spec.mjs
• npx playwright test --list --shard=1/3