feat(shared): JWT Validation Library

[refcell]

Summary

Closes #414

Adds a lightweight JWT validation library to crates/shared/jwt for fail-fast authentication with the engine API.

Ports logic from #395.

Changes

• JwtError / JwtValidationError - Error types for parsing and validation
• read_jwt_secret / default_jwt_secret / resolve_jwt_secret - JWT loading utilities
• JwtValidator - Engine API capability exchange with retry logic (behind engine-validation feature)

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 1 Sum 2

[haardikk21]

where is this gonna be used? does kona/reth not already validate JWTs for auth api?

[refcell]

where is this gonna be used? does kona/reth not already validate JWTs for auth api?

Yes and no -- the error output by reth is not clear to the user and it may take time after startup to error out since engine api calls don't happen right away. Kona only does this inside it's binary so we can't rely on kona here, we need to roll this validation ourself (that's why placing logic in crates makes it easier for downstream users like us to re-use that logic).

TL;DR: we will use this in the base consensus binary since it's not handled by the kona node service, only the binary.