feat(03-01): add ServeMux groups, JWT verifier, and serve command

Named middleware resolves at boot, HS256 tokens are pinned with required
exp/sub, and both binaries expose a signal-aware serve command.

Co-authored-by: Cursor <cursoragent@cursor.com>

surf/serve.go

@@ -0,0 +1,75 @@
+package surf
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+	"time"
+
+	"git.golem15.com/golem15/summercms/backpack"
+	"git.golem15.com/golem15/summercms/bonfire"
+	"git.golem15.com/golem15/summercms/lagoon"
+	"git.golem15.com/golem15/summercms/party"
+)
+
+// ServeCommand starts a signal-aware HTTP server on the assembled router.
+func ServeCommand(app *backpack.App, plugins []party.Plugin) bonfire.Command {
+	return bonfire.Command{
+		Name:        "serve",
+		Description: "Serve the application HTTP API",
+		Flags: []bonfire.Flag{{
+			Name:        "addr",
+			Description: "Listen address",
+			Default:     ":8080",
+		}},
+		Run: func(ctx context.Context, in bonfire.Input, out bonfire.Output) error {
+			addr, _ := in.Flag("addr")
+			if strings.TrimSpace(addr) == "" {
+				addr = ":8080"
+			}
+			sqlDB, gdb, err := lagoon.OpenFromApp(ctx, app)
+			if err != nil {
+				return err
+			}
+			defer sqlDB.Close()
+			if err := lagoon.Publish(app, sqlDB, gdb); err != nil {
+				return err
+			}
+			h, err := Assemble(app, plugins)
+			if err != nil {
+				return err
+			}
+			ctx, stop := signal.NotifyContext(ctx, os.Interrupt, syscall.SIGTERM)
+			defer stop()
+			srv := &http.Server{Addr: addr, Handler: h, BaseContext: func(net.Listener) context.Context { return ctx }}
+			errCh := make(chan error, 1)
+			go func() {
+				out.Info(fmt.Sprintf("listening on %s", addr))
+				errCh <- srv.ListenAndServe()
+			}()
+			select {
+			case <-ctx.Done():
+				shutdownCtx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+				defer cancel()
+				if err := srv.Shutdown(shutdownCtx); err != nil {
+					return err
+				}
+				err := <-errCh
+				if err == nil || err == http.ErrServerClosed {
+					return nil
+				}
+				return err
+			case err := <-errCh:
+				if err == nil || err == http.ErrServerClosed {
+					return nil
+				}
+				return err
+			}
+		},
+	}
+}