authkit: initial shared auth module

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

caller.go

@@ -0,0 +1,28 @@
+package authkit
+
+import "context"
+
+// Caller carries the identity of an authenticated API-key caller.
+type Caller struct {
+	Service    string
+	ServerName string
+	Scopes     []string
+}
+
+// Has reports whether the caller has the given scope.
+func (c *Caller) Has(scope string) bool {
+	return HasScope(c.Scopes, scope)
+}
+
+type ctxKeyCaller struct{}
+
+// WithCaller stores c in ctx under the authkit caller key.
+func WithCaller(ctx context.Context, c *Caller) context.Context {
+	return context.WithValue(ctx, ctxKeyCaller{}, c)
+}
+
+// CallerFromContext retrieves the Caller stored by WithCaller.
+func CallerFromContext(ctx context.Context) (*Caller, bool) {
+	c, ok := ctx.Value(ctxKeyCaller{}).(*Caller)
+	return c, ok
+}