feat(03-01): add ServeMux groups, JWT verifier, and serve command

Named middleware resolves at boot, HS256 tokens are pinned with required
exp/sub, and both binaries expose a signal-aware serve command.

Co-authored-by: Cursor <cursoragent@cursor.com>

cmd/summer/main.go

@@ -35,6 +35,7 @@ func toolCommands() []bonfire.Command {
 		delegateCommand("migrate", "Run plugin migrations in the app binary"),
 		delegateRollbackCommand(),
 		delegateCommand("migrate:status", "Show per-plugin migration history in the app binary"),
+		delegateCommand("serve", "Run the app HTTP server"),
 	}
 }