feat: add secure code worker pairing

[danny-avila]

Summary

• add one-time worker pairing with locally generated Ed25519 identities
• bind short-lived credentials to exact-request proof-of-possession with timestamp and nonce replay protection
• add automatic rotation, administrator revocation, owner-only identity storage, and jittered reconnects
• require paired authentication for hardened remote-bridge deployments
• record the stateful-environment architecture and security boundaries in ADR 001

Stack

This PR is stacked on #66 and should be reviewed after that remote-bridge foundation.

Verification

• npm test in packages/code (8 passing)
• full service suite (575 passing)
• bun run build in service
• targeted ESLint for changed service modules