JWKS caching via lestrrat-go/jwx, signature/iss/aud/exp validation, and a single gRPC interceptor that grpc-gateway's forwarded headers make work identically for REST callers.
Sets up go.mod/go.sum, buf (proto codegen) configuration, and the env-driven Config shared by the message-plane server and queue-operator.