OpaqueTokenAuthenticator

Implements opaque bearer-token authentication.

Extracts a raw token via TokenResolver: missing credentials yield AuthenticationResult.NotAuthenticated. Looks up the token via OpaqueTokenLookup; an unknown token yields AuthenticationResult.Failure. When OpaqueTokenDetails.expiresAt is set and is at-or-before clock's instant, yields AuthenticationResult.Failure with message "token expired". On success, returns AuthenticationResult.Success with the looked-up identity and roles. Construct via opaqueToken { } or Builder.