go-tiered-auth (extracted)
Tiered (track) access: wallet auth (nonce + JWT), feature flags by tier, RequireAuth/RequireTier/OptionalAuth. Source: backend/auth, backend/featureflags, backend/api/middleware/auth.go. DB tables stay in explorer migrations.