feat: enforce jwt allowed connection types with go-compatible semantics

src/NATS.Server/Auth/JwtAuthenticator.cs

@@ -95,6 +95,24 @@ public sealed class JwtAuthenticator : IAuthenticator
             }
         }
 
+        // 7b. Check allowed connection types
+        var (allowedTypes, hasUnknown) = JwtConnectionTypes.Convert(userClaims.Nats?.AllowedConnectionTypes);
+
+        if (allowedTypes.Count == 0)
+        {
+            if (hasUnknown)
+                return null; // unknown-only list should reject
+        }
+        else
+        {
+            var connType = string.IsNullOrWhiteSpace(context.ConnectionType)
+                ? JwtConnectionTypes.Standard
+                : context.ConnectionType.ToUpperInvariant();
+
+            if (!allowedTypes.Contains(connType))
+                return null;
+        }
+
         // 8. Build permissions from JWT claims
         Permissions? permissions = null;
         var nats = userClaims.Nats;