feat: add JWT auth, configurable username, switch password auth to Basic

Add server-side JWT authentication with permission-based access control
(read/write/delete claims). Password authentication now uses HTTP Basic
auth only (replacing Bearer). Add configurable username for both server
and client (--server-username/--client-username, defaults to "keep").

JWT secret supports file-based loading via --server-jwt-secret-file for
Docker secrets. OPTIONS preflight requests bypass auth. HEAD mapped to
read permission.

Co-Authored-By: opencode <noreply@opencode.ai>

src/modes/client/save.rs

@@ -100,11 +100,14 @@ pub fn mode(
 
     // Streamer thread: reads compressed bytes from pipe → POST to server
     let client_url = client.base_url().to_string();
+    let client_username = client.username().cloned();
     let client_password = client.password().cloned();
+    let client_jwt = client.jwt().cloned();
     let tags_clone = tags.clone();
 
     let streamer_handle = std::thread::spawn(move || -> Result<ItemInfo> {
-        let streaming_client = KeepClient::new(&client_url, client_password)?;
+        let streaming_client =
+            KeepClient::new(&client_url, client_username, client_password, client_jwt)?;
         let params = [
             ("compress".to_string(), server_compress.to_string()),
             ("meta".to_string(), "false".to_string()),