feat: JWT Token-based authentication for production (Release mode)

- Implemented JwtAuthenticationHandler for Bearer token validation
- Created LoginEndpoint for JWT token issuance (POST /api/auth/login)
- Added JWT configuration to appsettings.json (Key, Issuer, Audience, ExpirationMinutes)
- Updated Program.cs to use JWT authentication in Release mode (replaces FailClosedAuthenticationHandler)
- Registered System.IdentityModel.Tokens.Jwt NuGet package
- Token validation includes issuer, audience, expiration, and configurable clock skew
- Backward compatible: Development mode continues to use DevelopmentHeaderAuthenticationHandler

This enables production deployments to use standard JWT-based authentication instead of rejecting all requests.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

Directory.Packages.props

@@ -20,6 +20,7 @@
     <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.17.0" />
     <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.17.0" />
     <PackageVersion Include="Swashbuckle.AspNetCore" Version="10.2.3" />
+    <PackageVersion Include="System.IdentityModel.Tokens.Jwt" Version="7.3.0" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="18.8.1" />
     <PackageVersion Include="xunit" Version="2.9.3" />