feat: add JWT auth, configurable username, switch password auth to Basic

Add server-side JWT authentication with permission-based access control
(read/write/delete claims). Password authentication now uses HTTP Basic
auth only (replacing Bearer). Add configurable username for both server
and client (--server-username/--client-username, defaults to "keep").

JWT secret supports file-based loading via --server-jwt-secret-file for
Docker secrets. OPTIONS preflight requests bypass auth. HEAD mapped to
read permission.

Co-Authored-By: opencode <noreply@opencode.ai>

docker-compose.yml

@@ -9,14 +9,19 @@ services:
     environment:
       - KEEP_SERVER_ADDRESS=0.0.0.0
       - KEEP_SERVER_PORT=21080
+      # - KEEP_SERVER_USERNAME=keep
       # - KEEP_SERVER_PASSWORD=changeme
       # - KEEP_SERVER_PASSWORD_HASH=
+      # - KEEP_SERVER_JWT_SECRET=
+      # - KEEP_SERVER_JWT_SECRET_FILE=/config/jwt_secret
       # - KEEP_COMPRESSION=lz4
       # - KEEP_META_PLUGINS=
       # - KEEP_FILTERS=
       - KEEP_CONFIG=/config/config.yml
       # - KEEP_SERVER_CERT=/certs/cert.pem
       # - KEEP_SERVER_KEY=/certs/key.pem
+      # - KEEP_CLIENT_USERNAME=keep
+      # - KEEP_CLIENT_JWT=""
     restart: unless-stopped
     # For TLS, mount certificate files:
     # volumes: