feat(auth): M2 human auth foundation — JWT + GitHub OAuth verifier (#82)

[viktor-shcherb]

Summary

Adds the human-plane auth layer the dashboard (M4) and HITL flow (M3)
will consume. The dashboard runs the GitHub OAuth code flow client-side
(no Murmur-side OAuth app needed); Murmur receives the resulting
access_token and exchanges it for a session JWT.

• Schema (migration 0003): `users`, `publisher_members`,
  `refresh_tokens`, `human_audit`.
• JWT (HS256) — hand-rolled in `src/auth/jwt.ts` (node:crypto only,
  no library dep). Rejects `alg=none` and asymmetric algs. Constant-
  time signature compare. Carries memberships snapshot at issue time;
  soft-disable check on every request.
• GitHub OAuth verifier — `src/auth/oauth_github.ts`. Murmur is
  the verifier, NOT the OAuth client — the dashboard's OAuth app issues
  the access_token; Murmur just calls `/user` (+ `/user/emails` for
  private primaries) to validate.
• Endpoints — `POST /auth/exchange`, `POST /auth/refresh` (atomic
  rotate inside `BEGIN IMMEDIATE`), `DELETE /auth/session`. All under
  `/auth/*`, mounted only when `MURMUR_JWT_SECRET` is supplied.
• Audit — sign-in success/failure, refresh, revoke all written to
  `human_audit`.

Also closes #88 (migration race deploy false-failure)

While in flight, this PR also bundles the fix for the migration-race
bug that surfaced as the M1 deploy false-failure — `runMigrations`
re-checks `_migrations` under each migration's `BEGIN IMMEDIATE`
instead of pre-reading once outside the loop. The deploy chain
(`scripts/deploy.sh`'s `pnpm migrate` step + the container's startup
`runMigrations`) used to race when a new migration was pending; the
loser hit "table publishers already exists" and crashed. Post-fix, the
loser sees the freshly-committed row inside the lock and skips cleanly.
Regression test pins the invariant.

DoD coverage (issue #82)

• User + publisher_member tables with migrations
• GitHub OAuth provider integration + exchange/refresh/logout endpoints
• Audit log writes from every human-plane action
• Phase 2 plan documented (Google OAuth — adds rows; no schema change)
• Documentation in `docs/auth.md`
• Role enforcement on every human-plane API — there's no human-plane consumer in this PR; `requireRole` lands alongside M3 HITL routes. Tracked as a follow-up.
• Member-management CLI / API — no consumer yet; lands with M3 (HITL needs reviewers to invite). Tracked as a follow-up.

Test plan

• `pnpm test:unit` — 450 tests pass (jwt + auth + oauth_github +
  jwt_auth + bootstrap_auth + race-fix regression)
• `pnpm typecheck`, `pnpm lint`, `pnpm grep:all` — green
• Coverage for src/auth/**/*.ts: 87.43% lines / 86.51% branches /
  92.3% funcs (above 85% threshold)
• Post-merge: deploy to Hetzner, set `MURMUR_JWT_SECRET` (32
  random bytes), verify `POST /auth/exchange` against a real
  GitHub access token from `gh auth token`.
• Verify `/auth/*` 404s when `MURMUR_JWT_SECRET` is unset.

Operator setup

ONE env var required:

```bash

On the deploy host:

export MURMUR_JWT_SECRET="$(openssl rand -hex 32)"
echo "MURMUR_JWT_SECRET=$MURMUR_JWT_SECRET" >> /etc/murmur.env
systemctl restart murmur
```

Without it, the `/auth/*` routes 404 and the rest of the server is
unaffected (this PR's deploy is safe to merge before the env var lands).

Closes #82
Closes #88
🤖 Generated with Claude Code