OIDC-ready authentication with Guardian-based authorization.

Development without auth, production with Bearer JWT and JWKS validation.