## What it does

Splits HMAC verification so Reprint can authenticate signed headers
before doing any body hashing, while making the intended boundary
explicit: HMAC is for **small control-plane requests**, not large data
uploads.

The existing `verify()` and `verify_globals()` paths still work for
current small requests. Newer code can use `verify_control_request()`
for bounded protocol commands or `verify_content_hash()` when it already
has a digest.

## Rationale

Push/inverse-pull needs two different trust boundaries:

1. small commands such as session start, preflight, plan confirmation,
commit, cancel, and resume should be HMAC-authenticated;
2. large files/DB chunks should move through authenticated sessions with
per-chunk hashes and final manifests, not one whole-body HMAC.

That avoids reading or buffering a multi-megabyte body just to
authenticate it, and it keeps the future chunked upload flow compatible
with PHP hosts that buffer request bodies.

## Testing instructions

- `cd tests && ../vendor/bin/phpunit --colors=never HmacServerTest.php`
- `composer analyze`