Shared identity resolution and authorization client for SweetRPG's Go APIs: verifies bearer
tokens against auth-api (POST /authz/check), resolves the subject to the canonical
users._id via users-api (GET /profile), and exposes Gin middleware (ResolveViewer,
RequireAnyRole) that stashes the identity in the request context alongside Viewer(c),
Roles(c), Subject(c), and Token(c) accessors.