feat: Implement JWT signing and verification utility

[charliewwdev]

Create a module that generates signed JWTs (RS256 or HS256) and verifies/decodes them. Include configurable expiry, issuer, and audience claims.

---

Generated by OpenDev AI

Uses the jose library (ESM-native, zero-dependency) which supports both HS256 and RS256 out of the box and integrates cleanly with Node16 module resolution. Key decisions:

1. Two config types (HS256Config / RS256Config) give the compiler a discriminated union — TypeScript enforces that RS256 callers supply both keys and HS256 callers supply a secret, catching misconfiguration at compile time.
2. Separate signing vs verification keys for RS256 — resolveSigningKey imports via importPKCS8, resolveVerificationKey via importSPKI. This makes the public-only verification path explicit and prevents accidental private-key exposure to verification consumers.
3. Custom error classes (JwtExpiredError, JwtInvalidError) wrap jose's internal errors so callers can instanceof-check without depending on jose's error hierarchy directly.
4. expiresIn in seconds (default 3600) is the simplest contract for service-to-service use; jose accepts the "Xs" string format internally.
5. decodeJwt without verification is intentionally kept as a separate export — it's only for debugging or reading claims from already-trusted internal tokens, not a verification bypass.

Dependency to add: pnpm add jose in this workspace (or the monorepo root). jose v5 is the current stable release and is used here.