feat(library): add workspace-scoped search and JWT auth for Daedalus

- Extend library list endpoint with `include_workspace` and
  `with_item_count` query params to support Daedalus registry mirroring
- Expand search scope clause to three modes: workspace-only, workspace
  plus allowed user libraries, and global
- Add `allowed_libraries` field to SearchRequest for Phase-2 JWT claims
- Introduce JWT-based actor resolution using a synthetic service user
  (`MCP_JWT_SERVICE_USERNAME`) for Daedalus-originated requests

pyproject.toml

@@ -33,6 +33,8 @@ dependencies = [
     # Phase 5: MCP Server
     "fastmcp>=2.0,<3.0",
     "uvicorn[standard]>=0.30,<1.0",
+    # Phase 6: Per-turn signed JWTs from Daedalus
+    "PyJWT>=2.8,<3.0",
 ]
 
 [project.optional-dependencies]