cheers-server — the origin-side surface

The mint half of edge-verifiable auth (R019): everything that can create or destroy a session, plus the origin-homed stores. Holding any of this is origin-only power, which is why it lives below cheers-verify in the DAG and never leaks to the edge.

• [codec] — the concrete token codecs. The symmetric [PasetoV4Codec] (v4.local, encrypted) and [HmacBlobCodec] (HMAC-SHA256) impl both TokenMinter and TokenVerifier on one type, so they MUST live here — putting them in cheers-verify would re-grant mint to the edge. The asymmetric [PasetoV4SecretMinter] (Ed25519 secret key) mints only; its matching public verifier lives in cheers-verify.
• [store] — the origin stores [UserStore] and [RefreshStore] (CredentialStore, the device store, stays in cheers-core).
• [refresh] — refresh-token rotation with replay detection.
• [revocation] — [RevocationWriter], the cold-path write side (the edge holds cheers_verify::RevocationReader).
• [session] — the [SessionAuthority] facade that assembles the above.

This crate depends on cheers-verify (and through it cheers-core); the reverse never holds, which is what keeps the edge minter-free.