Expose a cache_ttl config key (default 3600s) covering both the
discovery document and JWKS caches. On JWT verification, peek at the
id_token's kid; if it is not present in the cached JWKS, flush and
refetch once so IdP key rotations are picked up without waiting for
the TTL to expire.

…imeouts

- Validate exp/nbf/iat in both the verified and unverified decode paths
  so an expired id_token is never accepted, even when verify_jwt is off.
- Add a clock_skew config key that applies leeway to the manual time-claim
  checks and to firebase/php-jwt's own checks.
- Handle IdP error responses on the callback (?error=...) and a missing
  authorization code with clear exceptions instead of blowing up inside
  the token exchange.
- Set Guzzle connect/read timeouts (5s/10s defaults) so a slow IdP does
  not tie up PHP workers. Both are configurable.

Add revoke($token, $tokenTypeHint) which posts to the IdP's
revocation_endpoint using the configured client authentication method.
Pair with the existing logout() helper to invalidate refresh tokens
server-side instead of waiting for them to expire.

Add verifyLogoutToken($logoutToken) which verifies a back-channel
logout token per the OIDC Back-Channel Logout 1.0 spec: signature,
iss, aud, iat/exp, jti presence, the required events claim, absence
of nonce, and presence of sub and/or sid. Returns the decoded claims
so the caller can de-dupe by jti and invalidate matching sessions.

Extend the revocation section with a session-based example showing how
to stash both id_token and refresh_token at login, and add a separate
"Storing tokens persistently" subsection with a database-backed
example (encrypted cast, updateOrCreate on login, revoke + clear on
logout) for apps that need refresh tokens to outlive the session.

Expand the back-channel logout section to explain that the IdP
identifies the session by a sid claim it mints itself, and that the
RP is responsible for storing a sid -> Laravel session id mapping at
login and consulting it at logout. Include a migration, the
updateOrInsert at login, and a route handler that prefers sid (per
session) and falls back to sub (all sessions for the user) when the
IdP does not support sid.