feat(auth): add a generic HS256 JWT issuer

[ChiragAgg5k]

Summary

Add Utopia\Auth\Issuers\Symmetric\Jwt for application-defined HS256 tokens, such as login state and session cookies, without requiring consumers to subclass the abstract issuer or misuse an OAuth refresh-token issuer.

• issue(string|array $audience, int $duration, array $claims = []) sets iss, aud, iat, and exp; custom claims cannot override them.
• Requires a positive duration and reuses the existing HS256 signing, JWT type, optional key ID, and secret-generation support.
• Documents issuance and verification, including the application’s responsibility for purpose checks, browser binding, membership, and replay protection.

Motivated by appwrite-labs/edge#1397. This PR only adds the library API; downstream Edge adoption follows after release. Branched from current main, with no unrelated DNS/domains changes.

Verification

• bin/monorepo test auth — 274 tests, 561 assertions passed on PHP 8.5.10.
• bin/monorepo check auth — Pint, PHPStan, and Rector passed.
• bin/monorepo validate — passed.
• vale packages/auth/README.md packages/auth/docs/jwt.md — 0 errors, one pre-existing README exclamation warning.
• git diff --check — passed.
• One-off PHP smoke checks against the local package autoloader — passed: issue/verify round trip, protected-claim overrides, custom-claim preservation, JOSE headers/key ID, audience arrays, rejection of non-positive durations, wrong key/issuer/audience/type, and payload tampering.

Added a small unit test covering signing/verification with string and array audiences, protected and custom claims, and rejection of zero/negative durations and empty/malformed audiences. Browser/Edge end-to-end verification was not run; this is a nonvisual library change, so screenshots are not applicable.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge with no outstanding correctness, security, or repository-rule violations.

Summary

• Protects issuer, audience, issued-at, and expiration claims from caller overrides.
• Requires a positive lifetime and validates audiences as non-empty lists of non-empty strings.
• Documents issuance, verification, and application-level security responsibilities.
• Adds behavioral coverage for issuance, verification, protected claims, audience forms, and invalid inputs.

_{Reviews (4) · Last reviewed commit: "fix(auth): reject empty and malformed JW..."}

[ChiragAgg5k]

@greptile review