max / makenotwork

server: bump jsonwebtoken to 10.4, on the rust_crypto provider 10.x makes the crypto backend pluggable and its default feature set enables NEITHER provider, so the crate compiles clean and then panics on the first sign or verify: "Could not automatically determine the process-level CryptoProvider". cargo check was clean while 14 of 20 synckit_auth tests failed, which would have shipped a server that panics on every sync login. Provider is rust_crypto (Max's call, 2026-07-22, standing preference for all projects): the same pure-Rust stack already backing sha2, hmac, and chacha20poly1305 here. The aws_lc_rs alternative was measured, not assumed — both are near-free on dependency count (rust_crypto nets +ed25519/-untrusted, and the rsa crate it pulls was already in the tree via apple-codesign and authenticode), so this is a stack preference rather than a cost tradeoff. Existing tokens keep working. A sync JWT built independently as raw HMAC-SHA256 over the base64url header/payload was pinned BEFORE the bump and still validates after, so nothing in the field is logged out on deploy; its exp is year-2100 so the vector will not rot, and it asserts a wrong secret is still rejected. 1890 lib + 1190 integration green, clippy clean at --all-targets --all-features. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>