feat(03-01): add ServeMux groups, JWT verifier, and serve command

Named middleware resolves at boot, HS256 tokens are pinned with required
exp/sub, and both binaries expose a signal-aware serve command.

Co-authored-by: Cursor <cursoragent@cursor.com>

examples/hello/plugins/greeter/plugin.go

@@ -2,17 +2,24 @@ package greeter
 
 import (
 	"context"
+	"fmt"
+	"net/http"
 
 	"git.golem15.com/golem15/summercms/backpack"
 	"git.golem15.com/golem15/summercms/bonfire"
 	"git.golem15.com/golem15/summercms/festival"
 	"git.golem15.com/golem15/summercms/pact"
 	"git.golem15.com/golem15/summercms/party"
+	"git.golem15.com/golem15/summercms/surf"
 	"git.golem15.com/golem15/summercms/towel"
 )
 
-var _ festival.Collectable = (*HelloEvent)(nil)
-var _ festival.Handleable = (*HelloEvent)(nil)
+var (
+	_ festival.Collectable = (*HelloEvent)(nil)
+	_ festival.Handleable  = (*HelloEvent)(nil)
+	_ pact.HasCommands     = (*Plugin)(nil)
+	_ pact.HasRoutes       = (*Plugin)(nil)
+)
 
 // Plugin is the golem15.greeter plugin. It requires golem15.hello.
 type Plugin struct {
@@ -49,6 +56,19 @@ func (p *Plugin) Boot(app *backpack.App) error {
 	return nil
 }
 
+func (p *Plugin) Routes(r pact.Router) error {
+	r.Get("/items/{id}", func(w http.ResponseWriter, req *http.Request) {
+		id, ok := surf.IntParam(req, "id")
+		if !ok {
+			http.NotFound(w, req)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		fmt.Fprintf(w, `{"id":%d}`, id)
+	})
+	return nil
+}
+
 func (p *Plugin) Commands() []bonfire.Command {
 	return []bonfire.Command{{
 		Name:        "greeter:hello",
@@ -110,8 +130,6 @@ func (e *HelloEvent) IsHandled() bool {
 	return e != nil && e.handled
 }
 
-var _ pact.HasCommands = (*Plugin)(nil)
-
 func init() {
 	party.Register(&Plugin{})
 }