M7.1 smoke harness: lift auth to compliance-core + compliance-smoke service (#83)

compliance-core/Cargo.toml

@@ -18,6 +18,15 @@ telemetry = [
     "dep:tracing-subscriber",
     "dep:tracing",
 ]
+# Pulls in the M7.1 Axum middleware + extractor. Consumers that don't
+# embed an HTTP server (e.g. the wasm dashboard frontend) leave it off.
+axum = [
+    "dep:axum",
+    "dep:jsonwebtoken",
+    "dep:reqwest",
+    "dep:tokio",
+    "dep:tracing",
+]
 
 [dependencies]
 serde = { workspace = true }
@@ -37,3 +46,7 @@ opentelemetry-appender-tracing = { version = "0.29", optional = true }
 tracing-opentelemetry = { version = "0.30", optional = true }
 tracing-subscriber = { workspace = true, optional = true }
 tracing = { workspace = true, optional = true }
+axum = { version = "0.8", optional = true }
+jsonwebtoken = { version = "9", optional = true }
+reqwest = { workspace = true, optional = true }
+tokio = { workspace = true, optional = true }