Walk me through how you’d implement JWT authentication in a Node.js API. Include where tokens are stored and what you’d do differently for a high-security context.