feat(auth-jwt-substrate): JWT session machinery, middleware, revocation

[themightychris]

Summary

• Implements JWT issuance, validation, refresh, and revocation for stateless session management per specs/behaviors/authorization.md and specs/api/auth.md
• Adds session middleware that decorates every request with request.session (person, accountLevel, personId, jti) via onRequest hook
• Implements GET /api/auth/me, POST /api/auth/refresh, POST /api/auth/logout, GET /api/auth/sessions, POST /api/auth/sessions/:jti/revoke
• OAuth endpoints (/api/auth/github/start, /api/auth/github/callback) return 501 oauth_not_yet_wired for the github-oauth plan to implement
• Revocation is two-layer: in-memory Set<jti> (O(1) hot path) + persisted revocations gitsheet (survives restarts); periodic sweeper clears expired records
• Session metadata (UA + IP + timestamps) stored in private bucket session-metadata.json — never in the public commit log
• Rate-limit plugin updated to use account-based keys when session is present (300/min reads, 30/min writes per account)
• Extends private store interface with readBlob/writeBlob for non-record arbitrary storage

Test plan

• mintSessionFor(personId) issues valid access + refresh JWTs that the verifier accepts
• cfp_claim token not accepted by verifyAccess (scope enforcement)
• GET /api/auth/me with valid cfp_session returns person + accountLevel
• GET /api/auth/me with no cookie returns {person:null, accountLevel:'anonymous'} 200
• Expired access JWT → anonymous (ME never 401s)
• POST /api/auth/refresh with valid refresh JWT returns new pair; old jti revoked
• POST /api/auth/refresh with revoked refresh JWT → 401 refresh_token_revoked
• POST /api/auth/logout clears cookies; subsequent /api/auth/me returns anonymous
• GET /api/auth/sessions lists non-revoked sessions; current marked current:true
• POST /api/auth/sessions/:jti/revoke with current session → 409 cannot_revoke_current_session
• POST /api/auth/sessions/:jti/revoke with unknown jti → 404
• OAuth endpoints return 501 oauth_not_yet_wired
• Authenticated reads key on account bucket (300/min), separate from IP bucket

🤖 Generated with Claude Code