Collier auth proof

Feasibility spike only. Not production authentication. No identity, no secrets. Routes: POST /proof/set, GET /proof/check, POST /proof/logout.