feat: migrate Nessa auth to Clerk session tokens (task 03)

- src/server/nessa-auth.ts: replace jose HS256 sign/verify with Clerk
  session JWT verification via @clerk/backend verifyToken (RS256/JWKS).
  signNessaToken removed — frontend now supplies Clerk session tokens.
- src/server/api/utils.ts: createTRPCContext verifies Clerk JWT, resolves
  ctx.nessaUserId via SELECT id FROM users WHERE clerkUserId=? on the
  shared NessaConnectionFactory. Lookup miss throws typed UNAUTHORIZED
  (webhook has not run yet). Invalid/expired tokens are swallowed; the
  enforceNessaUser middleware rejects null nessaUserId.
- src/server/api/routers/nessa-community-authz.test.ts: add clerkUserId
  lookup tests (seeded match, missing row, mismatched id, local≠clerk).
- src/server/nessa-auth.test.ts: verifyNessaToken unit tests with mocked
  @clerk/backend (valid sub, missing sub, malformed/expired/wrong-signature
  rejection) plus static audit that signNessaToken is gone.
- src/server/clerk-user-webhook.ts + src/routes/api/clerk-webhook.ts:
  Clerk user.created/user.updated webhook handler (Svix signature
  verification, idempotent upsert by clerkUserId, lazy ALTER TABLE
  migration) with full test suite.
- src/server/api/routers/nessa.ts: remove legacy register/login/google/
  apple sign-in mutations (Clerk is now the sole identity provider).
- src/env/server.ts: add NESSA_CLERK_SECRET, NESSA_CLERK_JWT_ISSUER,
  NESSA_CLERK_WEBHOOK_SECRET; NESSA_JWT_SECRET moved to optional.
- package.json: add @clerk/backend, svix; lineage/auth.test.ts and
  nessa-ownership.test.ts: add Clerk env vars to env mocks.
- .env.example: document Clerk config vars and rotation.
- delete nessa-google-oauth.test.ts (Google auth removed).

ctx.nessaUserId remains the local users.id — router bodies are untouched.

src/routes/api/clerk-webhook.ts

@@ -0,0 +1,52 @@
+import type { APIEvent } from "@solidjs/start/server";
+import { env } from "~/env/server";
+import { NessaConnectionFactory } from "~/server/database";
+import { handleClerkUserWebhook } from "~/server/clerk-user-webhook";
+
+function json(status: number, body: unknown): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+
+/**
+ * Clerk webhook endpoint — receives `user.created` / `user.updated` events.
+ *
+ * Configure the endpoint URL in the Clerk Dashboard → Webhooks
+ * (e.g. https://freno.me/api/clerk-webhook in prod, or an ngrok/dev url for
+ * local dev). The signing secret (`whsec_...`) is stored in
+ * `NESSA_CLERK_WEBHOOK_SECRET` and used to verify each request via Svix.
+ *
+ * The raw body is read verbatim from the inflight request so the Svix
+ * signature is computed over the exact bytes Clerk sent.
+ */
+export async function POST(event: APIEvent) {
+  const svixId = event.request.headers.get("svix-id");
+  const svixTimestamp = event.request.headers.get("svix-timestamp");
+  const svixSignature = event.request.headers.get("svix-signature");
+
+  if (!svixId || !svixTimestamp || !svixSignature) {
+    return json(400, { error: "Missing Svix signature headers" });
+  }
+
+  let rawBody: string;
+  try {
+    rawBody = await event.request.text();
+  } catch {
+    return json(400, { error: "Missing request body" });
+  }
+
+  const result = await handleClerkUserWebhook({
+    rawBody,
+    headers: {
+      "svix-id": svixId,
+      "svix-timestamp": svixTimestamp,
+      "svix-signature": svixSignature
+    },
+    webhookSecret: env.NESSA_CLERK_WEBHOOK_SECRET,
+    conn: NessaConnectionFactory()
+  });
+
+  return json(result.status, result.body);
+}