Fix cloud login: decode JWT payload with matlab.net.base64decode

[stevevanhooser]

Root cause

ndi.cloud.internal.decodeJwt decoded the JWT payload with javax.xml.bind.DatatypeConverter.parseBase64Binary. The Java shipped with the MATLAB used in CI (setup-matlab, release: latest) no longer includes javax.xml.bind, so the call fails with MATLAB:undefinedVarOrClass ("Unable to resolve the name 'javax.xml.bind.DatatypeConverter.parseBase64Binary'").

The call chain is ndi.cloud.authenticate → isAuthenticated → ndi.cloud.internal.getActiveToken → getTokenExpiration → decodeJwt. Every cloud test that logs in therefore errors before it sends a request.

Evidence:

• The nightly "Test NDI Cloud Api" workflow on main has failed daily since at least 2026-10-04. In run 38099712583 the dev job hits this error 68 times, with 107 tests failed.
• All three Cloud CI jobs on Add ndi.cloud.api.feedback commands and ndi.unittest.cloud.feedbackTest #1023 failed the same way. The diagnosis is in Add ndi.cloud.api.feedback commands and ndi.unittest.cloud.feedbackTest #1023 (comment).

Changes

• src/ndi/+ndi/+cloud/+internal/decodeJwt.m: a one-line change to matlab.net.base64decode(payloadBase64). The lines above it already turn Base64Url into padded standard Base64. The decoder returns a uint8 row, which native2unicode(..., 'UTF-8') accepts as before.
• New tests/+ndi/+unittest/+cloud/DecodeJwtTest.m: an offline test that needs no network or credentials. It builds JWTs locally (Base64Url via matlab.net.base64encode) and covers payloads with 0, 1 and 2 stripped padding characters. It also includes non-ASCII characters to exercise UTF-8 decoding, and checks the exp and email claims.
• A grep of src/ and tests/ found no other javax.xml.bind usage.

Testing

This change was not run locally, because MATLAB is not available in the environment where it was written (see AGENTS.md). The checking was static only, and CI is what verifies it.

Expected outcome: Cloud CI and the nightly cloud workflow stop failing at authentication. Unrelated cloud failures that this error was hiding may then show up.

🤖 Generated with Claude Code

https://claude.ai/code/session_01H3DDr2ybuwd2XoVfBEsU38

---

Generated by Claude Code

[github-actions]

Test Results

1 409 tests  ±0   1 376 ✅ +4   6m 44s ⏱️ -32s
  209 suites ±0      33 💤 ±0 
    1 files   ±0       0 ❌  - 4 

Results for commit 4a571dc. ± Comparison against base commit 846c4bd.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 30.17%. Comparing base (0a2cdec) to head (4a571dc).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1024      +/-   ##
==========================================
- Coverage   30.20%   30.17%   -0.04%     
==========================================
  Files         866      870       +4     
  Lines       44014    44076      +62     
==========================================
+ Hits        13296    13298       +2     
- Misses      30718    30778      +60     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[stevevanhooser]

codecov/project (30.17%, -0.04%) is red, but this PR didn't cause the drop. Codecov compared this head against 0a2cdec, a main commit from before #1023. The diff it reports (+4 files, +62 lines, +60 misses) is the four ndi.cloud.api.feedback files that #1023 added. This PR adds no files under src/ and changes only one line there. Codecov also reports that all modified, coverable lines in this PR are covered.

No fix is needed in this PR. The check may update when the Cloud CI 1/3 jobs upload coverage. I can't re-run a Codecov status from here.

---

Generated by Claude Code