feat(auth): shared token foundation (1/3)

[pandemicsyn]

Adds shared authentication support for audience-bound tokens while retaining legacy token acceptance.

Includes:

• Token policy validation and shared issuance/delegation helpers.
• Runtime authorization contracts with bounded lifetimes and current account/organization checks.
• Signed runtime-proxy proof verification in web authentication and Session Ingest.
• Signed organization scope taking precedence over request headers.
• Verified token claims exposed through Worker middleware, with matching Gastown/Wasteland types.
• Default-off master and per-family issuance settings, documented in ENVIRONMENT.md.

Merging deploys these readers and helpers. New token issuance remains disabled; producer endpoints, client migrations, and Cloud Agent runtime activation are separate changes.

Validation: 507 focused tests passed. Worker-utils, Session Ingest, web, Gastown, and Wasteland typechecks passed, along with scoped lint, formatting, and diff checks.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (27 files)

• ENVIRONMENT.md
• apps/web/src/lib/auth/resource-delegation.servicecontrol.test.ts
• apps/web/src/lib/auth/resource-delegation.test.ts
• apps/web/src/lib/auth/resource-delegation.ts
• apps/web/src/lib/config.server.resource-tokens.test.ts
• apps/web/src/lib/config.server.ts
• apps/web/src/lib/token.test.ts
• apps/web/src/lib/tokens.ts
• apps/web/src/lib/user/server.test.ts
• apps/web/src/lib/user/server.ts
• apps/web/src/routers/test-utils.ts
• packages/worker-utils/package.json
• packages/worker-utils/src/kilo-auth-middleware.test.ts
• packages/worker-utils/src/kilo-auth-middleware.ts
• packages/worker-utils/src/kilo-token-policy.test.ts
• packages/worker-utils/src/kilo-token-policy.ts
• packages/worker-utils/src/kilo-token.test.ts
• packages/worker-utils/src/kilo-token.ts
• packages/worker-utils/src/runtime-authorization-contract.ts
• packages/worker-utils/src/runtime-authorization.test.ts
• packages/worker-utils/src/runtime-authorization.ts
• packages/worker-utils/src/runtime-proxy-attestation.test.ts
• packages/worker-utils/src/runtime-proxy-attestation.ts
• services/gastown/src/middleware/auth.middleware.ts
• services/session-ingest/src/middleware/kilo-jwt-auth.test.ts
• services/session-ingest/src/middleware/kilo-jwt-auth.ts
• services/wasteland/src/middleware/auth.middleware.ts

---

_{Reviewed by grok-4.6 · Input: 200.1K · Output: 22.2K · Cached: 1.2M}

_{Review guidance: REVIEW.md from base branch main}