feat: add JWT authentication middleware

[wbavon]

Summary

• Add JWT-based auth middleware with HS256 token validation
• Bearer token required in Authorization header for all endpoints except /health
• JWT_SECRET env var is required (no hardcoded fallback)
• 7 test cases covering valid tokens, missing/invalid/expired tokens, and path skipping

Closes #3

Test plan

• All 12 tests pass (go test ./... -race)
• Guardrail check passed (no secrets, no security issues)

🤖 Generated with Claude Code