fix(06-12): reject typed-nil guards and fractional JWT subjects

bouncer/registry.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
+	"reflect"
 )
 
 type namedGuard struct {
@@ -32,6 +33,12 @@ func (reg *Registry) Register(pluginID, name string, g any) error {
 	if name == "" || g == nil {
 		return fmt.Errorf("bouncer: plugin %q registered empty guard %q", pluginID, name)
 	}
+	switch rv := reflect.ValueOf(g); rv.Kind() {
+	case reflect.Pointer, reflect.Map, reflect.Slice, reflect.Func, reflect.Chan, reflect.Interface:
+		if rv.IsNil() {
+			return fmt.Errorf("bouncer: plugin %q registered empty guard %q", pluginID, name)
+		}
+	}
 	_, isGuard := g.(Guard)
 	_, isCred := g.(CredentialGuard)
 	if !isGuard && !isCred {