Implement built-in auth

[streamer45]

Summary

• Add built-in JWT authentication for HTTP API/WebSocket and MoQ/WebTransport (JWKS endpoint, cookie sessions, token mint/list/revoke, key rotation).
• Update MoQ subscriber/publisher nodes and docs to support authenticated relays via ?jwt= and configurable params.
• Add startup warnings for common deploy footguns (auto-auth overriding proxy role headers; auth enabled without TLS).
• Improve admin UX: CLI token minting (skit auth mint ..., plus print-admin-token --raw) and UI copy buttons / tighter tokens table layout.

Addresses #5