Implement Supabase Edge Function for BankID assertion validation

Structure the Edge Function as three route handlers in a single function entry point (or three separate Edge Functions if Supabase routing is cleaner). Use the jose Deno library for JWT signature verification against the BankID JWKS endpoint. Cache the JWKS document using a module-level Map to avoid re-fetching on every invocation. The sessionId is a server-generated UUID stored in a short-lived Supabase table (e.g., bankid_sessions with a 10-minute TTL enforced by created_at + pg_cron or Postgres TTL extension).

The validate endpoint deletes the session row after successful validation to prevent replay. Use Deno's built-in crypto for any HMAC operations. Never use console.log with the assertion token or personnummer — use structured logging with redaction.

Deno unit tests for: (1) valid assertion token returns correct identity payload; (2) expired token returns ASSERTION_EXPIRED error; (3) tampered/invalid signature returns ASSERTION_INVALID error; (4) malformed request body returns HTTP 400; (5) missing or invalid Supabase JWT returns HTTP 401; (6) BankID broker returning an error maps to typed EdgeFunctionServerFailure response. Use Deno test mocking for the BankID broker HTTP calls. Integration test in Supabase local development environment using supabase functions serve with test BankID credentials. Document test environment BankID credentials in CI secrets.