'JWT issued at date claim (iat) is in the future': clock skew rejects good Clerk tokens

# Symptom
Errors mentioning the JWT `iat` claim being in the future, or `token-not-active-yet`. Often intermittent, often limited to specific servers, containers, or developer machines.

# Confirm the cause
1. Decode a failing token and compare its `iat` to current UTC time ON THE MACHINE THAT VERIFIES IT. If iat is ahead of that machine's clock, you found it.
2. Check both sides: the backend verifying the token and the machine running the browser. Either being off breaks verification.
3. Containers and VMs drift without NTP. A clock even a minute ahead is enough to reject fresh tokens.

# Fix
- Sync the machine clock with a time server (enable NTP on the host; for containers, fix the host clock since most containers share it).
- No code change is needed. This is infrastructure, not auth logic.

# Verify
After syncing, the exact same session token verifies. If the problem returns days later, the clock sync service is not running; fix that rather than the app.