eqosys: signed token, a Durable Object hub, and the first app signing in through it #2766

Follow-ups to #2764, in this order:

1. Signed token. /api/exchange hands back plain JSON. Add a short-lived signed token (JWKS at /.well-known/jwks.json) so an app's server or Durable Object can check who someone is without calling eqosys.
2. First app. Have Park Hide & Seek (already in APPS) send its players through /login and show the eqosys name.
3. Durable Object hub, one per person. Friends, presence ("playing Park Hide & Seek") and notifications across apps: the "discord" part. Live sockets belong in a DO; the user directory stays in D1.
4. Allow loopback return URLs for local development of a registered app, behind a flag.