feat(conformance): sign JWTs per-case in the harness (closes #41)

[milmazz]

Summary

Closes #41 by teaching the conformance harness to mint and sign a JWT from each case's request.jwt block, enabling the 12 pending auth cases (1460–1464, 1468–1474). Enabling them immediately exposed lib-side conformance bugs in the JWT error mapping, fixed in the same change — the first real end-to-end exercise of the verification path from #35.

Harness

• Bier.HttpCase.perform/1 signs the case's payload with jose and sends it as Authorization: Bearer. The symbolic sign_with: hs256_test_secret resolves to PostgREST's testCfg secret via a map in the harness (same pattern as the asymmetric JWK in Bier.ConformanceServer), keeping the YAML declarative.
• The payload is signed as-is: several cases deliberately carry invalid claim types (e.g. a string exp) that the server must reject, so the harness must not validate or coerce them.
• Cases 1468–1473 configure jwt-aud: youraudience, which is mutually exclusive with the shared instance's jwt_aud: nil, so they are added to @variant_case_ids and run on dedicated instances. 1474 (jwt-aud: null) matches the shared config and stays put.
• The :jwt arm of the pending_reason cond is gone.

Library fixes the cases exposed

Bier.JWT detected non-numeric exp/nbf/iat, wrong-typed aud, and audience mismatches, but collapsed them all into :jwt_invalid, rendered as PGRST301 / "JWSError JWSInvalidSignature". PostgREST v14.12 returns PGRST303 with specific messages. It also skipped aud type-checking entirely when no jwt-aud was configured, accepting object-valued aud claims with a 200.

• Bier.JWT now returns distinct reasons: {:claim_not_number, claim}, :aud_not_string, :not_in_audience; aud is type-checked unconditionally while membership is still only enforced when jwt-aud is configured (empty-array aud remains "no audience").
• Bier.Plugs.FallbackController maps each to 401 PGRST303 with PostgREST's exact wording (The JWT 'exp' claim must be a number, The JWT 'aud' claim must be a string or an array of strings, JWT not in audience).

Testing

• mix test --only area:auth — 45 tests, 0 failures (was 33 runnable + 12 pending).
• mix precommit — every gate passes; the only test failures are the pre-existing PostGIS geojson cases 1616–1618 ([conformance][env] PostGIS not installed for GeoJSON cases (1616-1618) #15), unrelated to this change.

🤖 Generated with Claude Code