perf: validate JWT locally instead of calling Supabase API

- Use jose library for ES256 JWT verification with cached JWKS
- Fallback to Supabase only if JWT verification fails
- Use findUnique instead of findFirst for DB lookup
- Estimated improvement: ~450ms -> ~5ms per request

bun.lock

@@ -5,6 +5,7 @@
     "": {
       "name": "bun-monorepo",
       "dependencies": {
+        "jose": "^6.2.2",
         "zod": "^4.3.6",
       },
       "devDependencies": {