feat(07-01): add JWT mint, refresh, and blacklist primitives

Co-authored-by: Cursor <cursoragent@cursor.com>

bouncer/context.go

@@ -1,13 +1,19 @@
 package bouncer
 
-import "context"
+import (
+	"context"
+	"time"
+)
 
 type userKey struct{}
 
 // Principal is the authenticated identity stored on the request context.
+// PreferredLocale empty means no override. TokensValidAfter zero means no cutoff.
 type Principal struct {
 	ID                 uint
 	MustChangePassword bool
+	PreferredLocale    string
+	TokensValidAfter   time.Time
 }
 
 // WithUser stores the verified principal on ctx.