Add JWT playback to all public components

[bluebird42]

Summary

• add one deduplicated customer-JWT to media-session exchange per embed
• keep the existing public CDN path unchanged when no token property is supplied
• expose a non-reflecting token property on player, clip, image, transcript, files, list, and pop components
• use bearer authorization for protected collection metadata and propagate the list token to child components
• preserve tokens when players move into mave-pop
• resolve protected manifests, HLS, posters, captions, and downloads through the media gateway without putting customer JWTs in media URLs
• forward token properties correctly through React and Vue adapters
• document property-based usage; mave-upload retains its separate upload-JWT contract

Validation

• TypeScript: tsc --noEmit
• production ESM/CJS/type build: tsup

Rollout dependency

Deploy after the media gateway infrastructure in https://github.com/maveio/infrastructure/pull/6. The core session endpoint and protected-space toggle are delivered in https://github.com/maveio/core/pull/18.