adlnet/moodle-jwt-auth ? reverse-engineered prompt

Build me a Moodle authentication plugin that lets a user log in automatically from an inbound JWT header and creates their Moodle account the first time they show up.

I want it to check the token issuer and client against environment settings, and if those match, trust the JWT and log the user in. It should also support choosing the username from either a special EDIPI field or another configurable claim, with an option to strip out unwanted characters using a regular expression. If the user does not already exist, create them, then sign them in.

Please make it fit naturally into Moodle’s auth plugin system, with a basic admin settings page, language strings, and any needed install or upgrade files. Keep it simple and assume the site is already protected before the request reaches Moodle. If you need to confirm current Moodle plugin conventions, look up the latest docs online.