Add the token half of Feathers-style auth, edge-native (Web Crypto, no
deps): a `jwt` module (HS256 sign/verify, expiresIn/subject/issuer/
audience, null-not-throw verify, alg:none refused) and a `bearerAuth()`
guard that reads `Authorization: Bearer`, verifies, and drives `auth()`.
`auth().id()` now honors a verified token over the session and needs no
session store. Local login (hash + login) unchanged; OAuth out of scope.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tn7UJG3uSLwPcWaKo9gHgC