feat: expose jwt helpers for app starter kit

[coladarci]

What

Adds verifyPeekAuthToken(token) to PeekAccessService and exports typed claim shapes so callers can verify Peek app registry JWTs without pulling in jsonwebtoken directly.

Why

The app starter kit needs to authenticate incoming requests from the Peek app registry. The token is an HMAC-signed JWT with a known shape (iss: "app_registry_v2", nested user object, display_version, etc.). Without this, each app would re-implement verify logic and define its own ad-hoc claim types.

Changes

• src/models/auth-token.ts — new PeekAuthTokenClaims and PeekAuthTokenUser interfaces modeled on the actual registry token shape
• PeekAccessService.verifyPeekAuthToken(token) — verifies signature (jwtSecret from config), expiry, and iss: "app_registry_v2"; returns typed claims; re-throws jsonwebtoken errors (JsonWebTokenError / TokenExpiredError / NotBeforeError) for callers to distinguish
• src/index.ts — exports PeekAuthTokenClaims and PeekAuthTokenUser
• 8 new tests: valid token (claims + user fields + isAdmin), wrong secret, wrong issuer, expired, malformed

Usage

import { PeekAccessService, type PeekAuthTokenClaims } from "@peektravel/app-utilities";

const peek = new PeekAccessService({ jwtSecret: process.env.PEEK_SECRET!, ... });

try {
  const claims: PeekAuthTokenClaims = peek.verifyPeekAuthToken(req.headers["x-peek-token"]);
  // claims.installId, claims.user.email, claims.user.isAdmin, ...
} catch (err) {
  // JsonWebTokenError, TokenExpiredError, NotBeforeError
}