feat(03-01): add ServeMux groups, JWT verifier, and serve command

Named middleware resolves at boot, HS256 tokens are pinned with required
exp/sub, and both binaries expose a signal-aware serve command.

Co-authored-by: Cursor <cursoragent@cursor.com>

pact/capabilities.go

@@ -2,6 +2,7 @@ package pact
 
 import (
 	"io/fs"
+	"net/http"
 
 	"git.golem15.com/golem15/summercms/bonfire"
 	"github.com/go-gormigrate/gormigrate/v2"
@@ -26,6 +27,30 @@ type HasMigrations interface {
 	Migrations() []*gormigrate.Migration
 }
 
+// Middleware is a named HTTP wrapper registered by a plugin.
+type Middleware func(http.Handler) http.Handler
+
+// HasMiddleware is implemented by plugins that register named middleware.
+type HasMiddleware interface {
+	Middlewares() map[string]Middleware
+}
+
+// Router is the Laravel-like group builder implemented by surf.
+type Router interface {
+	Group(prefix string, middleware []string, fn func(Router))
+	Get(path string, handler http.HandlerFunc, middleware ...string)
+}
+
+// HasRoutes is implemented by plugins that declare HTTP routes.
+type HasRoutes interface {
+	Routes(Router) error
+}
+
+// HasModels is implemented by plugins that expose GORM models.
+type HasModels interface {
+	Models() []any
+}
+
 // OptionalMessage is a service an optional plugin may publish so other
 // plugins can integrate without importing that plugin's package.
 type OptionalMessage interface {
@@ -33,12 +58,8 @@ type OptionalMessage interface {
 }
 
 // Future capability families are type-asserted when their first consumer
-// packages exist. Method payloads for HTTP/model surfaces are declared in
-// the phase that ships surf:
+// packages exist:
 //
-//	HasModels
-//	HasRoutes
-//	HasMiddleware
 //	HasJobs
 //	HasListeners
 //	HasAdminControllers
@@ -49,4 +70,5 @@ type OptionalMessage interface {
 //	HasLang
 //
 // The kernel type-asserts HasConfig (party, before Register), HasCommands
-// (generated app main, after Boot), and HasMigrations (lagoon migrate).
+// (generated app main, after Boot), HasMigrations (lagoon migrate), and
+// HasMiddleware/HasRoutes (surf assemble).