refactor: Extract _decode_token helper to remove duplication

The jwt.decode + authorized_parties check was duplicated between the
initial attempt and the retry path in both sync and async methods.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>