feat(authkit): add JWT-first access token flow

[jmgilman]

Summary

• add an authkit-owned access JWT issuer/verifier package
• add JWT-first protected-resource authentication that resolves principals from access JWTs
• add API-token-to-access-JWT exchange and remove runtime API-token authentication
• update notes example, tests, and docs for the exchange-first shape

Validation

• go test ./...
• moon run root:check --summary minimal
• git diff --check

Notes

• This intentionally removes apikey.NewAuthenticator, Service.VerifyToken, and compose.APIToken because authkit is still pre-stable and API tokens are now exchange credentials only.
• OIDC remains on the temporary identity-based path for a follow-up exchange slice.