Implement local agent JWT authentication for adapters

Add HS256 JWT-based authentication for local adapters (claude_local, codex_local)
so agents authenticate automatically without manual API key configuration. The
server mints short-lived JWTs per heartbeat run and injects them as PAPERCLIP_API_KEY.
The auth middleware verifies JWTs alongside existing static API keys.

Includes: CLI onboard/doctor JWT secret management, env command for deployment,
config path resolution from ancestor directories, dotenv loading on server startup,
event payload secret redaction, multi-status issue filtering, and adapter transcript
parsing for thinking/user message kinds.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/config-file.ts

@@ -1,11 +1,9 @@
 import fs from "node:fs";
-import path from "node:path";
 import { paperclipConfigSchema, type PaperclipConfig } from "@paperclip/shared";
+import { resolvePaperclipConfigPath } from "./paths.js";
 
 export function readConfigFile(): PaperclipConfig | null {
-  const configPath = process.env.PAPERCLIP_CONFIG
-    ? path.resolve(process.env.PAPERCLIP_CONFIG)
-    : path.resolve(process.cwd(), ".paperclip/config.json");
+  const configPath = resolvePaperclipConfigPath();
 
   if (!fs.existsSync(configPath)) return null;