Hermetic bearer-token authenticator for server-side and local testing.

Tokens are configured declaratively as a map keyed by raw token value:

%{
  "token-value" => %{
    client_id: "service-a",
    audiences: ["https://mcp.example.com/mcp"],
    scopes: ["tools:call"],
    principal: %{"sub" => "service-a"}
  }
}