#523 - Decompose auth middleware responsibilities

Parent: #523

## Objective
Split authentication middleware into focused units to improve maintainability and reduce bootstrap/runtime risk.

## In scope
- Separate JWT validation, user lookup/sync, role mapping, and permission resolution into composable functions
- Remove hard process termination from auth initialization path
- Keep existing auth outcomes and role assignment behavior

## Acceptance criteria
- `authmware` orchestration delegates to smaller testable functions/modules
- Initialization failures propagate through startup error handling instead of `process.exit` in middleware
- Existing auth behavior remains compatible for idir/bceid role mapping
- Unit tests added/updated for extracted units

## Notes
Prioritize readability and explicit error semantics over broad functional changes.