feat(03-01): add ServeMux groups, JWT verifier, and serve command

Named middleware resolves at boot, HS256 tokens are pinned with required
exp/sub, and both binaries expose a signal-aware serve command.

Co-authored-by: Cursor <cursoragent@cursor.com>

lagoon/commands.go

@@ -11,7 +11,7 @@ import (
 )
 
 // RuntimeCommands returns migrate, migrate:rollback and migrate:status.
-// Serve is registered once the HTTP layer exists.
+// Serve is registered separately via surf.ServeCommand.
 func RuntimeCommands(app *backpack.App, plugins []party.Plugin) []bonfire.Command {
 	return []bonfire.Command{
 		{