[feature] JWT APP auth strategy

[theorm]

Adds an authentication strategy that verifies a long-lived auth token issued by the web app and returns a new short-lived JWT token for the Public API.