feat(docver): add access token endpoint and Bearer auth on all endpoints

- POST /api/documents/token issues JWT HS256 (claims userid/username/fid/template) after x-api-key check against new env DOCVER_API_KEY (fail-closed, timing-safe, uniform 401)
- all docver endpoints now require Authorization: Bearer, verified with env DOCVER_TOKEN_SECRET (TTL via DOCVER_TOKEN_TTL_SECONDS, default 3600); secret unset = 401 on verify / 500 on issue
- identity (userId/userName) + templateId extracted from token claims instead of request payload; removed from multipart form (legacy fields now 400)
- lib/docver-token.ts: hand-rolled JWT via node:crypto only — alg pinned to HS256 (anti alg-confusion), timing-safe compare with both sides hashed, exp enforced, identical 401 for all bearer failure modes
- openapi spec: /api/documents/token path + DocverBearer scheme; PLAN-DOCVER.md / CLAUDE.md / .env.example updated
- tests: new tests/lib/docver-token.test.ts + adjusted parseVersionUploadForm tests (258 pass, no DB env needed)
- package-lock.json: sync minio (^8.0.7) that was missing from the earlier docver commit

Co-Authored-By: Claude Code <noreply@anthropic.com>

app/api/documents/[docId]/versions/[versionId]/download-link/route.ts

@@ -1,12 +1,14 @@
 // PLAN-DOCVER.md §1 — GET /api/documents/{docId}/versions/{versionId}/download-link?format=docx|pdf
 // คืน presigned URL อายุสั้น (env DOCVER_LINK_TTL_SECONDS) ให้ UI เปิดในเบราว์เซอร์จริง
 // ของผู้ใช้ — เช็คทั้ง docId และ versionId พร้อมกันกันโยน id ข้ามเอกสาร
+// auth: Authorization: Bearer (access_token จาก POST /api/documents/token — ทุก endpoint ของกลุ่ม)
 import {
   docverError,
   parseDocId,
   parseDownloadFormat,
   parseVersionIdParam,
 } from "@/lib/document-versioning";
+import { requireDocverBearer } from "@/lib/docver-token";
 import { findVersionForDoc, presignVersionUrl } from "@/lib/docver-store";
 
 export const runtime = "nodejs";
@@ -16,6 +18,9 @@ export async function GET(
   request: Request,
   { params }: { params: { docId: string; versionId: string } },
 ) {
+  const auth = requireDocverBearer(request);
+  if (!auth.ok) return auth.response;
+
   const docId = parseDocId(params.docId);
   if (!docId.ok) return docverError(docId.error, 400);
   const versionId = parseVersionIdParam(params.versionId);