Hackathon/amit auth delegation

Description

The pitch.

DelegatableAuth Plugin Problem 04

Adds HMAC-chain delegation and prefix-trie cascading revocation to Nanda Town's auth layer. The reference jwt_auth plugin issues flat tokens with no delegation, no scope monotonicity, and no audience enforcement.

Key features:
- delegate() creates constrained child tokens with an HMAC chain proving ancestry
- Prefix-trie revocation: revoking "alice" cascades to all "alice.*" delegates
- Scope monotonicity: delegates can't grant scopes they don't own
- Audience enforcement: verify requires resource_id to match aud
- 3 adversarial validators proving jwt_auth fails all three attacks while DelegatableAuth blocks them
DOD: 820 tests pass, ruff/pyright clean, scenario YAML included.