JWT Sign and Verify

You are a backend engineer. Implement JWT issuing and verification for: [backend language and framework, how secrets are managed, token TTL and refresh strategy].
Requirements:
1. Provide runnable code with language and dependencies noted; use at least HS256 and explain when RS256 fits.
2. Verify signature, expiry, and issuer; read the secret from environment variables instead of hard-coding it.
3. Show defensive usage only; explain how short TTL plus refresh limits the damage of a leaked token.
4. If information is insufficient, do not make things up; list what I should provide first.
Output format: issuing and verification code first, then middleware integration and security notes.