Forward Authorization in nginx; accept Spec 027 roles in JWT decode. Co-authored-by: Cursor <cursoragent@cursor.com>
Specs stay at repo root (cross-VM). Move deploy and code into logical projects with README per domain, updated manifest.yaml, and symlinks at legacy paths for VM122 backward compatibility.