Stamp 2.58.0 native JWT middleware and useAuthApi.

Same skip paths, Bearer/query token, Clerk RS256 leftover, and local HS256
contract. routers/auth.py, user records, and AUTH_JWT_SECRET are untouched.

tests/test_periscope_csp_middleware_rewrite.py

@@ -25,4 +25,5 @@ def test_middleware_package_is_src_and_does_not_export_auth():
     assert "from backend.middleware.auth" not in text
     assert "verify_request_user" not in text
     auth = ROOT / "periscope" / "src" / "backend" / "middleware" / "auth.py"
-    assert not auth.exists()
+    assert auth.is_file()
+    assert "verify_request_user" in auth.read_text(encoding="utf-8")