#42 feat(tokens): implement path-scoped relayfile tokens

Summary

• replace the /v1/tokens/path 501 stub with real relay_pa_* path token pair issuance
• accept workspace tokens through x-api-key and the cloud-compatible Authorization: Bearer relay_ws_* form
• normalize relayfile path globs, enforce requested path scopes against the workspace token grant, and preserve path-token refresh lineage
• update SDK/types/tests/docs for the real path token response

Self-review

• Checked that normal bearer JWT auth remains unchanged: only Bearer relay_ws_* is treated as API-key-backed workspace-token auth.
• Checked that derived path tokens keep workspaceTokenId metadata, so existing workspace-token revocation checks still close the lineage.
• Checked that /foo/** normalizes to /foo/*, and arbitrary scopes outside the requested path set are rejected before issuance.

Verification

• npm --workspace @relayauth/server exec -- node --test --import tsx src/__tests__/tokens-route.test.ts
• npm --workspace @relayauth/sdk exec -- node --test --import tsx src/__tests__/client-tokens.test.ts
• npm --workspace @relayauth/server run typecheck
• npm --workspace @relayauth/sdk run typecheck
• npm --workspace @relayauth/types run typecheck
• git diff --check

Closes #40