Function jwks_on_demand_refresh_decision 

pub fn jwks_on_demand_refresh_decision(
    now_ms: i64,
    last_refresh_ms: i64,
    min_pause_ms: i64,
) -> JwksOnDemandDecision

Keep the limiter monotonic and fail closed across wall-clock rollback: refresh exactly when jwks_on_demand_refresh_allowed holds, stamping now_ms as the new last-refresh time.