Add grpcserver package: gRPC server with method-map auth

- MethodMap with Public, AuthRequired, AdminRequired maps
- Default deny for unmapped methods (safety net)
- Auth interceptor: extracts Bearer token from metadata,
  validates via Authenticator, sets TokenInfo in context
- Logging interceptor: method, code, duration
- TLS 1.3 optional (skipped for testing)
- TokenInfoFromContext helper
- 10 tests with mock MCIAS

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

go.mod

@@ -5,6 +5,7 @@ go 1.25.7
 require (
 	github.com/go-chi/chi/v5 v5.2.5
 	github.com/pelletier/go-toml/v2 v2.3.0
+	google.golang.org/grpc v1.79.3
 	modernc.org/sqlite v1.47.0
 )
 
@@ -14,7 +15,11 @@ require (
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	golang.org/x/net v0.48.0 // indirect
 	golang.org/x/sys v0.42.0 // indirect
+	golang.org/x/text v0.32.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
 	modernc.org/libc v1.70.0 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect