feat(auth): enable audience-aware readers for chat and KiloClaw

[pandemicsyn]

Summary

Phase 4, batch 2: enable resource-audience validation for Kilo Chat, Event Service, Notifications, and the active KiloClaw JWT readers. Each accepts correctly addressed tokens or supported audience-less legacy tokens, and rejects explicit mismatches or malformed audiences.

Stacked on #5815 to reuse its opt-in shared verifier. This PR contains one batch-two commit; retarget to main after batch one merges.

Verification

No manual browser or deployed-service testing was performed. This is a reader-only backend change; real signed-token and middleware behavior was exercised through automated suites using local Worker runtimes and mocked dependencies rather than production credentials. Automated results are listed below.

Visual Changes

N/A

Reviewer Notes

• Chat, Event Service, and Notifications retain their existing current-pepper, blocked-account, environment, context, and error-response behavior. The shared one-hour audience-less chat token remains accepted across all three.
• KiloClaw is limited to its central JWT reader plus regressions for bearer/cookie middleware and the access-gateway cookie fast path, consistent with its October 2026 EOL. Its distinct missing-environment and absent-pepper rules remain intact. No controller, renewal, provisioning, or grant redesign.
• Tests cover accepted string/array audiences, mismatches before account lookup or downstream execution, malformed claims, legacy access, pepper revocation, environment checks, dependency failures, and invalid-bearer versus valid-cookie precedence.
• No token issuers, lifetimes, opaque connection tickets, internal secrets, or other service readers changed. The gateway cookie shortcut retains its existing no-pepper-lookup behavior; this is not a revocation redesign.
• Batch one must land first. Audience-bearing issuers migrate separately after their consumers are ready.

Automated validation on the final stacked base:

• 3,209 tests passed: Kilo Chat 428, Event Service 40, Notifications 213, KiloClaw 2,336, and shared JWT verification/authentication/policy 192.
• Lint and typecheck passed for all four services; formatting and git diff --check passed.
• The full Chat suite exited successfully while emitting local missing-R2-secret errors and dependency sourcemap warnings; those diagnostics were not hidden or treated as production verification.
• Range-diff confirmed the batch-two patch was unchanged when unrelated main-merge history was removed from the PR.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (10 files)

• services/event-service/src/auth.ts
• services/event-service/src/__tests__/auth.test.ts
• services/kilo-chat/src/auth.ts
• services/kilo-chat/src/__tests__/auth.test.ts
• services/kiloclaw/src/auth/jwt.ts
• services/kiloclaw/src/auth/jwt.test.ts
• services/kiloclaw/src/auth/middleware.test.ts
• services/kiloclaw/src/routes/access-gateway.test.ts
• services/notifications/src/auth.ts
• services/notifications/src/__tests__/auth.test.ts

Previous Review Summary (commit aff7f5a)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit aff7f5a)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (10 files)

• services/event-service/src/auth.ts
• services/event-service/src/__tests__/auth.test.ts
• services/kilo-chat/src/auth.ts
• services/kilo-chat/src/__tests__/auth.test.ts
• services/kiloclaw/src/auth/jwt.ts
• services/kiloclaw/src/auth/jwt.test.ts
• services/kiloclaw/src/auth/middleware.test.ts
• services/kiloclaw/src/routes/access-gateway.test.ts
• services/notifications/src/auth.ts
• services/notifications/src/__tests__/auth.test.ts

---

_{Reviewed by grok-4.6 · Input: 91.6K · Output: 7.8K · Cached: 380.7K}

_{Review guidance: REVIEW.md from base branch feat/worker-audience-readers-batch-1}