Performs decrypt-then-verify operation: decrypts nested JWE to reveal inner JWS,
then verifies the signature and extracts original plaintext.

Decryption and verification key identifiers are automatically extracted from
token headers per JOSE standards (RFC 7516 §4.1.4, RFC 7515 §4.1.4).

Both keys must be homogeneous (both symmetric or both asymmetric). COMPOSITE
keys are supported via JWE/JWS General JSON Serialization format.

Key type combinations:

• Symmetric + Symmetric (e.g., AES-GCM + HMAC-SHA256)
• Asymmetric + Asymmetric (e.g., ML-KEM + ML-DSA, RSA + RSA)
• COMPOSITE + COMPOSITE (e.g., COMPOSITE_KEM_COMBINE + COMPOSITE_SIGNATURE)
• COMPOSITE + SIMPLE (any homogeneous combination)

Returns 422 if signature verification fails or token format is invalid.