feat(ts): allow a pre-minted JWT instead of an API key

[unknwon]

Summary

Lets the TypeScript SDK accept a caller-supplied JWT instead of an ES256 private key. When a token is provided, the client sends it verbatim on every authenticated request rather than minting a fresh JWT per call.

This is the natural unit for "act as an end user our backend already minted a token for" — the token's own claims (repo, scopes, expiry) govern access.

Changes

• GitStorageOptions: key is now optional; added optional token. Constructor requires name plus either key or token.
• generateJWT: short-circuits to return the supplied token verbatim, so all existing call sites flow through unchanged. Per-call permissions / ttl / refPolicies are ignored in token mode (documented).
• New constructor error messages: requires a name, requires either a key or a token, token must be a non-empty string.
• README: updated GitStorageOptions interface + added a token-init example.

Caveats

• name is still required in token mode (used to derive default API/storage base URLs).
• A supplied token is fixed to one repo + one scope set — a read-only token fails on writes; a token for repo A won't work against repo B. Inherent to this approach and called out in the README.
• Python and Go SDKs are not changed in this PR — TS only, by request. Happy to mirror in follow-ups.

Test evidence

pnpm --filter @pierre/storage build — success (incl. DTS).
pnpm --filter @pierre/storage exec vitest --run — 196 passed.

Added tests: construct-with-token, empty-token rejection, and an end-to-end check that the supplied token is sent verbatim as the Authorization: Bearer header. Updated existing constructor-validation assertions for the new error messages.