refactor(search,auth): export pure helpers for direct testing

encodeCursor/decodeCursor/firstSnippet (opensearch) and
decodeJwtPayload (verify) become public exports so tests can
hit them without round-tripping through fetch.

src/auth/verify.ts

@@ -7,7 +7,7 @@ interface DidDocument {
   service?: { id: string; serviceEndpoint: string }[];
 }
 
-function decodeJwtPayload(token: string): JwtPayload {
+export function decodeJwtPayload(token: string): JwtPayload {
   const parts = token.split(".");
   if (parts.length !== 3) throw new Error("Invalid JWT format");
   const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");