dumpd /me reports the decoded discord_id; the gateway page shows it on hover

The quickest way to confirm the Vanguard profile scope mapping is live, without echoing the raw token: the
browser never sees X-Authentik-Jwt, so printing it would hand the user a bearer token for the proxy provider.
Decoding is display-only and never feeds an authorisation decision. Verified against eight inputs including a
numeric claim, a missing claim, a non-token and malformed base64.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

about/index.html

@@ -185,6 +185,7 @@ $('l-clips').href = sub('clips') + '/'; document.querySelectorAll('a.l-clips').f
     const r = await fetch('/me', {credentials:'same-origin'}); const d = await r.json(); if (!r.ok) throw new Error(d.error || r.status);
     $('who').textContent = d.name && d.name !== d.user ? `${d.name} (${d.user})` : d.user;
     $('pills').innerHTML = d.groups.map(g => `<span class="pill">${g}</span>`).join('') || '<span class="pill">no groups yet — ask an admin for a role</span>';
+    if (d.discord_id) $('who').title = 'Discord ID ' + d.discord_id;   // apps identify you by this, not by your name
     const has = g => d.groups.includes(g);
     const show = (id, on) => $(id).classList.toggle('hidden', !on);
     // sections appear only for what this account can actually do (the gates check these same groups)