feat(viewer-context): Restore ViewerContext from JWT in middleware

[gricha]

Middleware decodes X-Viewer-Context on incoming requests.

• Auth user always wins; header only used when no user is authenticated
• Dual-mode: accepts both JWT (new) and JSON + HMAC signature (legacy)
• Org ID mismatch between header and auth user logged as error
• Parsing logic lives in viewer_context.py as viewer_context_from_header()
• Verification keys in _get_verification_keys() — currently just SEER_API_SHARED_SECRET

Depends on #112765.

[azulus]

I don't think this is unauthenticated

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 50eb38f. Configure here.}

[cursor]

JWT overrides token-authenticated requests without user

Low Severity

The middleware determines whether a request is "authenticated" solely by checking request_ctx.user_id is not None, but a request can be authenticated via an org auth token without having a user (e.g., org-scoped API tokens). In that case, user_id is None and the JWT context silently overrides the org auth token's organization_id and drops the token field entirely — with no mismatch warning logged, since the org-ID comparison only runs inside the user_id is not None branch. The PR description states JWT is only for "unauthenticated service-to-service calls," but this condition doesn't account for token-based authentication without a user.

 

^{Reviewed by Cursor Bugbot for commit 50eb38f. Configure here.}

[azulus]

not a big fan of the magic key here, maybe better as a const somewhere. I know it's a jwt thing but still weird to read