sec: add jti and replay-protect subscribe tokens

[EthanY33]

Summary

Closes #7.

VerifyToken previously checked only expiry + HMAC, so a subscribe token observed on the wire (a misconfigured upstream proxy log, a Referer leak, etc.) was reusable for its full 5-minute window. Anyone with a valid socket connected to wirefan could replay it.

This PR adds a jti (token nonce) and an in-process replay cache.

Token format (internal — no external callers depend on this)

	before	after
layout	<expMs>:<b64mac>	<expMs>:<jti>:<b64mac>
HMAC over	expMs|sock|chan	expMs|sock|chan|jti

jti is a fresh 16-byte hex string per SignToken call. It's inside the HMAC payload, so an attacker can't swap a new jti onto a captured signature.

ReplayCache

New auth.ReplayCache is a jti -> expiry map with three methods:

• CheckAndRecord(jti, exp) — returns true first time, false thereafter.
• Sweep() — removes entries past expiry.
• Len() — for tests / metrics.

Server constructs one per process and starts sweepReplayCache on a 1-minute ticker for the lifetime of ctx. Memory is bounded by issuance rate × token lifetime (5 min default).

Verify path

// New cache-aware path; production callers use this.
auth.VerifyTokenAgainst(secret, sock, chan, tok, cache)

// Backward-compatible no-replay-check shim; equivalent to cache=nil.
auth.VerifyToken(secret, sock, chan, tok)

handleSubscribe now passes c.replayCache and distinguishes AUTH_REPLAYED from AUTH_FAILED so a client + its operator can tell "bad token" from "already used."

What changed

• internal/auth/token.go: jti in token format; new VerifyTokenAgainst; new ReplayCache; ErrTokenReplayed.
• internal/auth/token_test.go: 4 new test cases.
• internal/conn/conn.go: Run takes *auth.ReplayCache; field on Conn.
• internal/conn/handler.go: handleSubscribe calls VerifyTokenAgainst and emits AUTH_REPLAYED on ErrTokenReplayed.
• internal/conn/conn_test.go, internal/conn/handler_test.go: pass nil cache.
• internal/server/upgrade.go: UpgradeHandler.replayCache; NewUpgradeHandler takes it; threads it into conn.Run.
• internal/server/server.go: Server.replayCache; New constructs it; sweepReplayCache goroutine; ReplayCache() accessor.
• internal/server/upgrade_test.go, internal/server/leak_test.go, internal/server/shutdown_test.go: pass nil.

Test plan

• go build ./... clean.
• go test ./internal/auth/... ./internal/conn/... ./internal/server/... passes (4 new cases plus existing).
• Manual: /v1/auth/sign once, subscribe twice with the same tok → first succeeds, second errors with AUTH_REPLAYED.
• Manual: leave the server running >5 min after sign, then attempt the same tok → AUTH_FAILED (expired) before replay check fires.

Conflict notes

• internal/conn/handler.go overlaps with PR sec: GC empty channels and rate-limit subscribe/unsubscribe #20 (channel GC + sub rate limit).
• internal/server/upgrade.go overlaps with PR sec: parse X-Forwarded-For from trusted proxies via WIREFAN_TRUSTED_PROXIES #19 (--trust-proxy) and sec: sanitize ws-upgrade error logs and validate sqlite path #16 (sanitize-logs).
• internal/server/server.go overlaps with PR sec: split admin listener and require explicit --allowed-origins #18 (listener split).
• internal/conn/conn.go overlaps with PR sec: add per-conn publish rate limit alongside per-key bucket #21 (per-conn token bucket).

All overlaps are additive (different fields / different lines). Whichever lands first; the rest need a small textual rebase. The token-format change is internal-only (no on-the-wire surprise for old clients of unrelated services).