feat(03-01): add ServeMux groups, JWT verifier, and serve command

Named middleware resolves at boot, HS256 tokens are pinned with required
exp/sub, and both binaries expose a signal-aware serve command.

Co-authored-by: Cursor <cursoragent@cursor.com>

pact/capabilities_test.go

@@ -117,3 +117,32 @@ func TestOptionalMessageContract(t *testing.T) {
 type extraMessage struct{ s string }
 
 func (e extraMessage) Message() string { return e.s }
+
+type routesOnly struct{}
+
+func (routesOnly) Routes(Router) error { return nil }
+
+type middlewareOnly struct{}
+
+func (middlewareOnly) Middlewares() map[string]Middleware {
+	return map[string]Middleware{"jwt.auth": nil}
+}
+
+type modelsOnly struct{}
+
+func (modelsOnly) Models() []any { return []any{struct{}{}} }
+
+func TestHTTPCapabilitiesDiscoveredByTypeAssertion(t *testing.T) {
+	var r HasRoutes = routesOnly{}
+	if err := r.Routes(nil); err != nil {
+		t.Fatal(err)
+	}
+	var m HasMiddleware = middlewareOnly{}
+	if _, ok := m.Middlewares()["jwt.auth"]; !ok {
+		t.Fatal("missing jwt.auth")
+	}
+	var models HasModels = modelsOnly{}
+	if len(models.Models()) != 1 {
+		t.Fatalf("Models = %+v", models.Models())
+	}
+}