feat(03-01): add ServeMux groups, JWT verifier, and serve command

Named middleware resolves at boot, HS256 tokens are pinned with required
exp/sub, and both binaries expose a signal-aware serve command.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/build/build.go

@@ -88,6 +88,7 @@ func generateMain(m Manifest) ([]byte, error) {
 	b.WriteString("\t\"git.golem15.com/golem15/summercms/lagoon\"\n")
 	b.WriteString("\t\"git.golem15.com/golem15/summercms/pact\"\n")
 	b.WriteString("\t\"git.golem15.com/golem15/summercms/party\"\n")
+	b.WriteString("\t\"git.golem15.com/golem15/summercms/surf\"\n")
 	b.WriteString(")\n\n")
 	b.WriteString("func main() {\n")
 	b.WriteString("\tif err := run(os.Args[1:], os.Stdout); err != nil {\n")
@@ -106,6 +107,7 @@ func generateMain(m Manifest) ([]byte, error) {
 	b.WriteString("\t\treturn err\n")
 	b.WriteString("\t}\n")
 	b.WriteString("\tcommands := lagoon.RuntimeCommands(app, plugins)\n")
+	b.WriteString("\tcommands = append(commands, surf.ServeCommand(app, plugins))\n")
 	b.WriteString("\tfor _, plugin := range plugins {\n")
 	b.WriteString("\t\tif hasCommands, ok := plugin.(pact.HasCommands); ok {\n")
 	b.WriteString("\t\t\tcommands = append(commands, hasCommands.Commands()...)\n")

internal/build/build_test.go

@@ -97,6 +97,9 @@ func TestGenerateStableQuotedImportsInManifestOrder(t *testing.T) {
 	if !bytes.Contains(mainSrc, []byte("lagoon.RuntimeCommands")) {
 		t.Fatalf("main does not register lagoon runtime commands:\n%s", mainSrc)
 	}
+	if !bytes.Contains(mainSrc, []byte("surf.ServeCommand")) {
+		t.Fatalf("main does not register serve:\n%s", mainSrc)
+	}
 	if bytes.Contains(mainSrc, []byte("examples/hello")) {
 		t.Fatal("generated main hard-codes examples/hello")
 	}