feat(03-01): add ServeMux groups, JWT verifier, and serve command

Named middleware resolves at boot, HS256 tokens are pinned with required
exp/sub, and both binaries expose a signal-aware serve command.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/build/build_test.go

@@ -97,6 +97,9 @@ func TestGenerateStableQuotedImportsInManifestOrder(t *testing.T) {
 	if !bytes.Contains(mainSrc, []byte("lagoon.RuntimeCommands")) {
 		t.Fatalf("main does not register lagoon runtime commands:\n%s", mainSrc)
 	}
+	if !bytes.Contains(mainSrc, []byte("surf.ServeCommand")) {
+		t.Fatalf("main does not register serve:\n%s", mainSrc)
+	}
 	if bytes.Contains(mainSrc, []byte("examples/hello")) {
 		t.Fatal("generated main hard-codes examples/hello")
 	}