Add REST API authentication (JWT)

[shiv-tyagi]

Problem

The REST API (spurrestd) has zero authentication. Any HTTP client can submit, cancel, and query jobs without credentials. The router is created with no auth middleware — all routes are publicly accessible. This is a critical security gap that blocks production deployment.

Expected Behavior

Slurm's slurmrestd supports JWT token authentication via Authorization: Bearer <token> header, with user identity extracted from JWT claims and authorization checks for admin vs regular user operations.

Spur already has an AuthConfig in spur-core/src/config.rs with plugin: "jwt" and jwt_key fields — the config infrastructure exists but is unused by spurrestd.

Acceptance Criteria

• Auth middleware validates JWT tokens from the Authorization header
• Valid JWT extracts username, uid, and admin status into an AuthUser
• Expired or invalid JWT returns 401
• Missing Authorization header returns 401
• /ping endpoint remains accessible without auth
• Authenticated user identity passed to submit/cancel RPCs for authorization
• --no-auth flag available for development/testing (with warning log)
• Reuses existing AuthConfig from spur-core