Add JWT-based authentication for non-browser API clients after the initial cookie-backed HTML UI is implemented.\n\nContext:\n- The first URL shortener UI will use cookie-backed server sessions.\n- JWT should be introduced later for programmatic/API clients, not as the initial browser session mechanism.\n\nScope:\n- Define API authentication endpoints and token lifetime.\n- Issue signed JWTs for API clients.\n- Validate Authorization: Bearer tokens on API routes.\n- Keep browser HTML flows on cookie-backed sessions unless a later design says otherwise.\n- Add tests for token issuance, expiration, invalid signatures, and auth-required API routes.
Add JWT-based authentication for non-browser API clients after the initial cookie-backed HTML UI is implemented.\n\nContext:\n- The first URL shortener UI will use cookie-backed server sessions.\n- JWT should be introduced later for programmatic/API clients, not as the initial browser session mechanism.\n\nScope:\n- Define API authentication endpoints and token lifetime.\n- Issue signed JWTs for API clients.\n- Validate Authorization: Bearer tokens on API routes.\n- Keep browser HTML flows on cookie-backed sessions unless a later design says otherwise.\n- Add tests for token issuance, expiration, invalid signatures, and auth-required API routes.