feat(03-01): serve seeded genres behind JWT middleware

golem15.user registers jwt.auth, golem15.fonoteka mounts GET /_fonoteka/api/v1/genres
through that guard, and a smoke test reads the 15 migrated rows with a test-only token.

Co-authored-by: Cursor <cursoragent@cursor.com>

plugin.go

@@ -5,33 +5,59 @@ import (
 	"io/fs"
 
 	"git.golem15.com/golem15/summercms/backpack"
+	"git.golem15.com/golem15/summercms/bouncer"
 	"git.golem15.com/golem15/summercms/pact"
 	"git.golem15.com/golem15/summercms/party"
 	"github.com/go-gormigrate/gormigrate/v2"
 )
 
 var (
-	_ party.Plugin       = (*Plugin)(nil)
-	_ pact.HasConfig     = (*Plugin)(nil)
-	_ pact.HasMigrations = (*Plugin)(nil)
+	_ party.Plugin         = (*Plugin)(nil)
+	_ pact.HasConfig       = (*Plugin)(nil)
+	_ pact.HasMigrations   = (*Plugin)(nil)
+	_ pact.HasMiddleware   = (*Plugin)(nil)
+	_ pact.HasModels       = (*Plugin)(nil)
+	_ bouncer.UserProvider = gormUsers{}
 )
 
 //go:embed config
 var configFS embed.FS
 
 // Plugin is the stub golem15.user plugin.
-type Plugin struct{}
+type Plugin struct {
+	app *backpack.App
+}
 
 func (p *Plugin) ID() string         { return "golem15.user" }
 func (p *Plugin) Requires() []string { return nil }
 
-func (p *Plugin) Register(*backpack.App) error { return nil }
-func (p *Plugin) Boot(*backpack.App) error     { return nil }
+func (p *Plugin) Register(app *backpack.App) error {
+	p.app = app
+	return nil
+}
+
+func (p *Plugin) Boot(app *backpack.App) error {
+	p.app = app
+	_, err := jwtSecret(app)
+	return err
+}
 
 func (p *Plugin) ConfigFS() fs.FS { return configFS }
 
 func (p *Plugin) Migrations() []*gormigrate.Migration { return migrations }
 
+func (p *Plugin) Models() []any { return []any{User{}} }
+
+func (p *Plugin) Middlewares() map[string]pact.Middleware {
+	secret, err := jwtSecret(p.app)
+	if err != nil {
+		return nil
+	}
+	return map[string]pact.Middleware{
+		"jwt.auth": bouncer.Middleware(secret, gormUsers{app: p.app}),
+	}
+}
+
 func init() {
 	party.Register(&Plugin{})
 }