team-cert-verification

# Team certificate verification Use this when your service is a BYOT relying party: agents present a DIDKey signature plus an AWID team certificate on every team-scoped request. The code ground truth is `src/folio/auth.py`; the test ground truth is `tests/test_auth_v2_envelope.py`. Port both and keep the tests green. ## Envelope contract Every team-scoped request carries four headers: ```http Authorization: DIDKey <did:key:z6Mk...> <base64url-no-padding-ed25519-signature> X-AWEB-Timestamp: <RFC3339 UTC timestamp> X-AWID-Team-Certificate: <base64-standard-json-team-certificate> X-AWEB-Signed-Payload: <base64url-no-padding canonical-JSON of the signed payload> ``` `X-AWEB-Signed-Payload` decodes to canonical JSON with these fields: ```json {"aud":"https://<service-origin>","body_sha256":"<sha256 hex of request body>","method":"<UPPER>","path":"<raw path?query>","team_id":"<team>:<namespace>","timestamp":"<RFC3339 UTC timestamp>","v":2} ``` Rules: - The signed-payload header is base64url with no padding (`=` is rejected in folio; see `src/folio/auth.py:137-146`). - Parsed JSON must round-trip to the same canonical bytes: `canonical_json(parsed) == decoded bytes` (`src/folio/auth.py:188-193`). - The Ed25519 signature verifies over those decoded presented bytes, not over a payload the server reconstructs (`src/folio/auth.py:217-220`). ## Ten verification steps Follow this implementation order when porting `src/folio/auth.py`. The cert is parsed early to obtain `tea...