JWT claim + docs-vs-implementation detector (v0.3.0)

[Shakargy]

Summary

Second verification slice, proving the claim registry generalizes.

• New built-in claim jwt-authentication - "Authentication uses JWT access tokens", powered by the existing JWT purpose classifier (access vs invitation/verification tokens)
• New contradiction detector (docs-vs-implementation): documentation claims JWT while the only JWT usage found is invitation-purpose -> CONTRADICTED with both sides and exact paths
• Honesty rule preserved: docs with NO usage found is WEAK (missing evidence), never CONTRADICTED - absence is not positive conflicting evidence
• Evaluator registry replaces single-claim dispatch: adding claims = adding definitions

Bug found and fixed

Signal metadata_json was hardcoded to '{}' at persistence since V0 - every extractor's metadata silently dropped. Concept detection never noticed (it runs in-process on live Signal objects); the verification engine is the first feature reading metadata back from the database, and it exposed the bug immediately. Fixed with a regression test asserting the JWT purpose survives the round-trip.

Verification

• 126 tests passing (6 new: SUPPORTED/WEAK/CONTRADICTED/UNKNOWN for the JWT claim, both-sided contradiction content, metadata persistence regression, verify-all returns both claims)
• demo-saas now verifies both claims: billing-webhook-signature SUPPORTED, jwt-authentication SUPPORTED (access usage + decision corroboration)
• build + twine clean

No breaking changes. Version 0.3.0. No tag, no publish - awaiting approval.