[Mathieu2301]

Summary

• verify browser users as audience-bound Miakapp access tokens through the existing control-plane JWKS cache
• remove Firebase certificate and project configuration from the stateless relay
• derive and bind the complete user identity, Home, role, scope, UID, and verified email from signed claims
• add real Auth-emulator, App Check, control-plane, Chromium, key-rotation, and two-relay handoff evidence
• pin the canonical V3 contract, V3 browser fixture, and serialized MiakAPI browser lifecycle

Validation

• gofmt clean
• go mod verify
• go vet ./...
• go test -race -coverprofile
• go build ./cmd/miakapp-server
• canonical control-plane authentication vectors
• real MiakAPI coordinator and Chromium integration
• full two-relay platform integration
• non-publishing Docker image build
• independent logic, security, and documentation review