feat: tunnel JWT auth

Tunnel method now requires Bearer JWT (HMAC-HS256) in gRPC metadata.
   - internal/auth: pure-stdlib verifier + issuer + revoked-jti list
   - internal/tunnel: per-target rate limiter + egress allowlist with
     wildcard support + crypto/rand frame padding to {1KB, 4KB, 16KB}
   - cmd/server reads /etc/stats-gateway/{jwt.key,tunnel.yaml,revoked.txt}
     via --config-dir flag
   - cmd/issue-token Go binary wraps auth.Issue
   - configs/tunnel.yaml example with projectshitpost wildcard


Tests: 13 PASS across 5 packages.

internal/tunnel/tunnel_test.go

@@ -0,0 +1,22 @@
+package tunnel
+
+import "testing"
+
+func TestAllowEgress(t *testing.T) {
+	cfg := EgressConfig{Allowed: []string{"192.0.2.10:8443", "*.projectshitpost.fun:443"}}
+	cases := []struct {
+		target string
+		want   bool
+	}{
+		{"192.0.2.10:8443", true},
+		{"foo.projectshitpost.fun:443", true},
+		{"projectshitpost.fun:443", false}, // wildcard "*.x" doesn't match bare "x"
+		{"8.8.8.8:53", false},
+		{"192.0.2.10:22", false},
+	}
+	for _, tc := range cases {
+		if got := cfg.Allow(tc.target); got != tc.want {
+			t.Errorf("Allow(%q) = %v, want %v", tc.target, got, tc.want)
+		}
+	}
+}