feat(06-01): implement inv_token guard, inv.scope, and registry wiring

- Verify inv_ tokens against ApiToken hash, expiry, revocation, last-used
- InvScope writes PHP TokenScope 401/403 bodies and gates on HasScope
- Register jwt and inv_token on the shared bouncer.Registry at plugin Boot

plugin.go

@@ -42,7 +42,8 @@ func (p *Plugin) Register(app *backpack.App) error {
 
 func (p *Plugin) Boot(app *backpack.App) error {
 	p.app = app
-	if _, err := classes.JWTSecret(app); err != nil {
+	secret, err := classes.JWTSecret(app)
+	if err != nil {
 		return err
 	}
 	if gdb, ok := app.Lookup[*gorm.DB](); ok {
@@ -50,7 +51,14 @@ func (p *Plugin) Boot(app *backpack.App) error {
 			return err
 		}
 	}
-	return nil
+	reg, ok := app.Lookup[*bouncer.Registry]()
+	if !ok || reg == nil {
+		reg = bouncer.NewRegistry()
+		if err := app.Publish(reg); err != nil {
+			return err
+		}
+	}
+	return reg.Register(p.ID(), "jwt", bouncer.NewJWTGuard(secret, classes.GormUsers{App: app}))
 }
 
 func (p *Plugin) ConfigFS() fs.FS { return configFS }
@@ -60,13 +68,18 @@ func (p *Plugin) Migrations() []*gormigrate.Migration { return updates.All() }
 func (p *Plugin) Models() []any { return models.All() }
 
 func (p *Plugin) Middlewares() map[string]pact.Middleware {
-	secret, err := classes.JWTSecret(p.app)
+	if p.app == nil {
+		return nil
+	}
+	reg, ok := p.app.Lookup[*bouncer.Registry]()
+	if !ok || reg == nil {
+		return nil
+	}
+	mw, err := reg.Middleware("jwt")
 	if err != nil {
 		return nil
 	}
-	return map[string]pact.Middleware{
-		"jwt.auth": bouncer.Middleware(secret, classes.GormUsers{App: p.app}),
-	}
+	return map[string]pact.Middleware{"jwt.auth": mw}
 }
 
 func init() {