perf: validate JWT locally instead of calling Supabase API

- Use jose library for ES256 JWT verification with cached JWKS
- Fallback to Supabase only if JWT verification fails
- Use findUnique instead of findFirst for DB lookup
- Estimated improvement: ~450ms -> ~5ms per request

package.json

@@ -6,6 +6,7 @@
     "packages/*"
   ],
   "dependencies": {
+    "jose": "^6.2.2",
     "zod": "^4.3.6"
   },
   "scripts": {