LINUS ROUND 5: RS256 default auth, middleware, full integration

- main.go: RS256Service with AAMOS public key, fallback to HS256
- auth/rs256.go: Middleware() for RS256 Bearer validation
- auth/rs256_test.go: 6 RS256 tests (middleware + validation)
- 27/27 auth tests passing, 82.6% coverage
- Build passes, all services operational

backend/auth/rs256.go

@@ -5,7 +5,9 @@ import (
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
+	"net/http"
 	"os"
+	"strings"
 
 	"github.com/golang-jwt/jwt/v5"
 )
@@ -51,6 +53,34 @@ func NewRS256Service(publicKeyPath string) (*RS256Service, error) {
 	}, nil
 }
 
+// Middleware returns HTTP middleware that validates Bearer tokens using RS256
+func (s *RS256Service) Middleware() func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			authHeader := r.Header.Get("Authorization")
+			if authHeader == "" {
+				http.Error(w, `{"error":"missing authorization header"}`, http.StatusUnauthorized)
+				return
+			}
+
+			if !strings.HasPrefix(authHeader, "Bearer ") {
+				http.Error(w, `{"error":"invalid authorization format"}`, http.StatusUnauthorized)
+				return
+			}
+
+			tokenString := strings.TrimPrefix(authHeader, "Bearer ")
+			claims, err := s.ValidateToken(tokenString)
+			if err != nil {
+				http.Error(w, `{"error":"invalid token"}`, http.StatusUnauthorized)
+				return
+			}
+
+			ctx := WithClaims(r.Context(), claims)
+			next.ServeHTTP(w, r.WithContext(ctx))
+		})
+	}
+}
+
 // ValidateToken verifies an RS256 JWT token
 func (s *RS256Service) ValidateToken(tokenString string) (*Claims, error) {
 	token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {