A2A 1.0 authorization hook backed by adk_jwt_policy.

Configure the already validated policy as a2a_v1_jwt_policy. The bearer token is read only from request headers by the policy and is never returned in the principal or retained by the A2A task store.