feat: tunnel JWT auth

Tunnel method now requires Bearer JWT (HMAC-HS256) in gRPC metadata.
   - internal/auth: pure-stdlib verifier + issuer + revoked-jti list
   - internal/tunnel: per-target rate limiter + egress allowlist with
     wildcard support + crypto/rand frame padding to {1KB, 4KB, 16KB}
   - cmd/server reads /etc/stats-gateway/{jwt.key,tunnel.yaml,revoked.txt}
     via --config-dir flag
   - cmd/issue-token Go binary wraps auth.Issue
   - configs/tunnel.yaml example with projectshitpost wildcard


Tests: 13 PASS across 5 packages.

cmd/issue-token/main.go

@@ -0,0 +1,33 @@
+package main
+
+import (
+	"bytes"
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"time"
+
+	"github.com/bergabruh/stats-gateway/internal/auth"
+)
+
+func main() {
+	keyPath := flag.String("key", "/etc/stats-gateway/jwt.key", "path to HMAC secret key file")
+	subject := flag.String("sub", "", "client-id (required)")
+	days := flag.Int("days", 90, "token validity in days")
+	flag.Parse()
+
+	if *subject == "" {
+		log.Fatal("--sub required")
+	}
+
+	secret, err := os.ReadFile(*keyPath)
+	if err != nil {
+		log.Fatalf("read key: %v", err)
+	}
+	tok, err := auth.Issue(bytes.TrimSpace(secret), *subject, "tunnel", time.Duration(*days)*24*time.Hour)
+	if err != nil {
+		log.Fatal(err)
+	}
+	fmt.Println(tok)
+}