feat: expose reusable SSO human authentication #490

Problem

The confirmed RFC 9068 verifier and active-human SSO binding are bundled into token issue/revoke. A future management HTTP handler cannot authenticate before reading its operation body without duplicating authentication or prematurely invoking management.

Scope

Expose a reusable internal PostgreSQL SSO human authenticator over the existing trusted JWT-verification port and exact binding reader. Capture ports once, validate bounded token input before verifier/SQL, return only the current active human principal ID, and retain private rejection versus dependency-failure errors. Refactor existing issue/revoke to reuse it without changing input-before-authentication ordering, policies, decisions, lifetime caps or mutations. Preserve existing gateway error exports and error-class identities.

Public HTTP paths/errors/audit, lifetime-error status changes, configuration provisioning and deployment activation remain separate decisions; do not implement unanswered HTTP options here.

Acceptance

• Runtime-signed valid JWTs authenticate only exact pre-registered active human bindings.
• Malformed tokens, rejected verification and missing/inactive/service bindings stop before management; malformed verifier outputs and dependency failures expose fixed claim-free errors.
• Every call re-verifies and reloads current binding state; caller fields/getters/mutations cannot nominate an actor or alter captured identity.
• No policy, credential mutation, audit or usage work is added to authentication itself.
• Preserve existing service behavior and error imports, test red/green through public boundaries and run npm run check.

Assisted-by: Codex