Edge auth v1: signed fallback capabilities and provider-specific credential broker #74

Goal

Establish the trust boundary for authenticated package fallback at the Cloudflare edge without forwarding a user's raw SSH key, PAT, npm token, or other long-lived credential.

This is the first implementation slice of the authenticated-outage program.

Scope

• Define a short-lived signed edge capability contract for read-only fallback.
• Verify capabilities locally in Cloudflare Workers from pinned/cached asymmetric JWK material so verification does not depend on zed-api-server or Shared Auth being reachable.
• Bind capabilities to issuer, audience, subject, expiry, package coordinate, provider, and allowed operation.
• Add a provider-specific broker/plan boundary for GitHub, npm, and private Cargo registries.
• The capability must contain references/authorizations, never provider secrets.
• Require exact provider hosts and exact resource bindings; no arbitrary Authorization replay.
• Make private/authenticated responses explicitly non-cacheable.
• Add negative tests for wrong audience, expiry, unknown kid, unsupported alg, provider/resource mismatch, and arbitrary-host attempts.

Non-goals for this PR

• Do not turn on production private GitHub/npm/Cargo fallback yet.
• Do not mint GitHub App installation tokens at the edge.
• Do not allow writes through this capability.
• Do not support crates.io as a private registry.

Follow-ups

1. Shared Auth / zed-api-server capability issuance endpoint.
2. GitHub App installation-token exchange.
3. npm private-scope credential exchange.
4. private Cargo registry/Git source credential exchange.
5. outage E2E matrix in zed-e2e.
6. production route wiring after the negative-control suite is green.