feat(03-01): add ServeMux groups, JWT verifier, and serve command

Named middleware resolves at boot, HS256 tokens are pinned with required
exp/sub, and both binaries expose a signal-aware serve command.

Co-authored-by: Cursor <cursoragent@cursor.com>

examples/hello/main.go

@@ -13,6 +13,7 @@ import (
 	"git.golem15.com/golem15/summercms/lagoon"
 	"git.golem15.com/golem15/summercms/pact"
 	"git.golem15.com/golem15/summercms/party"
+	"git.golem15.com/golem15/summercms/surf"
 )
 
 func main() {
@@ -33,6 +34,7 @@ func run(args []string, out io.Writer) error {
 		return err
 	}
 	commands := lagoon.RuntimeCommands(app, plugins)
+	commands = append(commands, surf.ServeCommand(app, plugins))
 	for _, plugin := range plugins {
 		if hasCommands, ok := plugin.(pact.HasCommands); ok {
 			commands = append(commands, hasCommands.Commands()...)