Module auth 

Caller-identity resolution for forge requests.

Three schemes, tried in order (cites JSS forge auth by name only):

1. Forge push token — Authorization: Bearer f1.… verified by crate::token::verify (cheap HMAC, no signature per call).
2. Pod session — the embedding server’s own getAgent/WAC layer resolves a pod account and passes a ForgeAgent::Pod directly to crate::ForgeService::handle; this module does not re-resolve it.
3. NIP-98 — Authorization: Nostr <base64> verified by the core solid_pod_rs::auth::nip98 verifier (real Schnorr when the nip98-schnorr feature is unified in, fail-closed otherwise).

Any failure resolves to ForgeAgent::Anonymous; the service’s guards then decide, fail-closed.

Functions

resolve_agent

Resolve a ForgeAgent from the request’s Authorization header. token_key is the forge instance HMAC key; now is the current Unix time (injected for deterministic testing).