Why is a JWT-based API typically configured as stateless, and what does that change?

A JWT carries the user's identity and claims signed inside the token itself, so the server doesn't need to keep a session store to know who's making a request — it just verifies the signature on each call. This means `SessionCreationPolicy.STATELESS` is set in the security config, load balancing becomes trivial (any server instance can validate any token), but it also means there's no server-side session to instantly invalidate on logout.