Stamp 2.58.0 native JWT middleware and useAuthApi.

Same skip paths, Bearer/query token, Clerk RS256 leftover, and local HS256
contract. routers/auth.py, user records, and AUTH_JWT_SECRET are untouched.

tests/test_periscope_frontend_content_overlay.py

@@ -28,9 +28,9 @@ def test_legal_pages_are_operator_not_faradworks_controller():
     assert "This Service is **not** operated by Faradworks, Inc." in terms
 
 
-def test_changelog_stamp_is_2_57_0_and_src_wins():
+def test_changelog_stamp_is_2_58_0_and_src_wins():
     text = (SRC / "changelog.md").read_text(encoding="utf-8")
-    assert "## 2.57.0 — 2026-09-20" in text
+    assert "## 2.58.0 — 2026-09-20" in text
     first = changelog_paths()[0]
     assert first.parts[-3:] == ("src", "frontend", "content") or first.name == "changelog.md"
     assert first == SRC / "changelog.md"