[pzanella]

Adds optional token checks to the relay. Without the new flags the stream stays public, as before.

./stream.sh bbb --auth                  # new signing key for each run
./stream.sh bbb --auth-key my-key.jwk   # your own key, tokens stay valid across runs

With either flag:

• The relay only accepts connections and HTTP API calls with a JWT signed with the key. Without a token, or with a token from another key, it answers 401.
• stream.sh prints a viewer token (subscribe only, valid 24 hours) and the player URL with the token in it.
• stream.sh signs a publish token for its own publishers (content, ads, SGAI signaling).
• Keys and tokens are made with moq token inside the Podman image, so nothing else is needed on the host.

Also:

• New CI job smoke-test-podman-auth.
• README: new section "Access control (JWT)", plus notes in the player, SGAI, HTTP API and troubleshooting sections.

Tested locally:

• --auth and --auth-key: base, CSAI, SSAI and SGAI.
• Rejected cases: no token, a token from another key, and a viewer token trying to publish.
• Public mode: all smoke tests still pass.