5.0.0-beta4

• Critical GraphQL auth/security hardening:
  • JWTs are now signature-verified (HS256) instead of decoded without verification.
  • Auth context token wiring was corrected.
  • Protected resolver auth checks now fail closed for account and dataset operations.
• Added server regression tests for:
  • unsigned/invalid JWT rejection
  • unauthenticated denial of createUserAccount, deleteAccount, and deleteDataSet
• Fixed monorepo build stability:
  • i18n TypeScript/Node typing config updated to restore successful root builds.
• Release docs clarified:
  • GitHub tag/release is the default workflow.
  • npm publish is documented as optional.
• No user-facing feature additions; this update is security, stability, and release-process cleanup.