Internal Security
This package owns the application's administrator JWT policy. It is kept
inside internal because its claims, audience, issuer and password-version
fields are KRA-specific security protocol, not a reusable JWT utility.
Generic stateless helpers may live in pkg, but admin token signing and
verification stay here so other services cannot accidentally depend on this
application's security contract.