Question 1: Is it possible to brute force this token signature?
Theoretically, Yes. BUT Two things you need to consider before even attempting to brute-force:
First: Does the secret change for every web token? If yes, then your cracking efforts are only good for that one token. Does the token contain so valuable information that you are willing to spend days or years worth of computational power on cracking it? Ask this to yourself.
Second: What is the length of your "encoded (header).encoded(payload).signature with a secret"? If you have access to unlimited processing power or unlimited amount of money, I suggest you read this post to understand how expensive, it will be to crack your hash.
Question 2: How is the difficulty to brute-force sha256?
Refer to second consideration of answer to question 1.
Question 3: In JWT, break sha256 secret = successfully replicate the signature?
I am not a JWT expert. However, if you believe the answers to above questions are acceptable, that means I understand the concept. So, to answer your question: Refer back to first consideration of answer to question 1. If your secret changes for every web token, you cannot replicate the signature to replay a transaction. Unless, if the secret change is trivial to predict, such as a numbered sequence. If the secret stays constant, then yes, you can replicate the signature.