feat: implement server-side Privy auth with replay protection

[juzigu40-ui]

What this PR does

• replaces the client-side placeholder hook in src/privy-auth.ts with a server-side PrivyAuthService
• verifies Privy JWTs against the issuer JWKS and enforces iss, aud, sub, exp, nbf, and iat
• consumes a one-time nonce before session minting to block replay
• signs and verifies app session tokens for protected backend routes
• updates exports, env template, and README so the flow is usable without extra glue code

Design choices

• kept the implementation backend-focused because the issue is about Privy auth integration, not UI wiring
• the token verifier is injectable for testing or custom verification flows
• the nonce store is pluggable; default is in-memory so the package stays runnable out of the box
• the implementation stays on built-in Node crypto, which keeps the auth dependency surface smaller

Validation

• npm test passes locally
• current coverage includes 7 cases:
• session mint and verification
• nonce replay rejection
• missing nonce rejection
• expired session rejection
• tampered session signature rejection
• session audience mismatch rejection
• env-based config construction

Implementation note

This version does not add an extra JWT helper dependency; the signing and verification path stays on built-in Node crypto, which keeps the runtime surface smaller for a library package.

Follow-up

If you want a specific acceptance target on top of this (Redis-backed nonce storage, claim contract, token lifetime policy, or example middleware), I can add it on the same branch.