Add signed op auth authoredAt claims

[marcus-pousette]

Summary

• add signed OpAuth.claims.authoredAtMs metadata for locally signed ops
• introduce a v2 op-signature input that covers auth claims, while still accepting v1 auth without claims
• encode claims in Sync v0 protobuf and preserve them in SQLite/Postgres proof-material stores
• expose the auth session signer public key for later local materialization metadata plumbing

Notes

• stacked on auth/session-options-cleanup / Simplify auth session options #141
• this does not yet surface verified signer/time on materialization events; that should be a follow-up after the materialization source and sync metadata boundaries settle
• authoredAtMs is author-signed claimed time, not globally trusted clock time