Token introspection (RFC 6750-style) for backend Bridge plugins. A plugin (e.g. bridge-nestjs) that receives an `x-api-key` API token POSTs it here to learn whether it is active and what it is scoped to, instead of verifying the signature locally. This keeps API tokens signed with the per-app HS256 secret (which the plugin never holds) while giving the plugin instant revocation — the Bridge re-checks the backing record on every call. The endpoint is intentionally unauthenticated: the presented token IS the credential, and the response only ever echoes claims already inside that token. A forged/invalid/revoked token yields `{ active: false }` and nothing else — no information leak. App-scoping is enforced cryptographically (only the issuing app's secret verifies the signature); the caller is responsible for comparing the returned `appId` to its own configured appId.