feat: add JwtAuthenticator with account resolution, revocation, and template expansion

src/NATS.Server/NatsOptions.cs

@@ -90,6 +90,10 @@ public sealed class NatsOptions
     public OcspConfig? OcspConfig { get; set; }
     public bool OcspPeerVerify { get; set; }
 
+    // JWT / Operator mode
+    public string[]? TrustedKeys { get; set; }
+    public Auth.Jwt.IAccountResolver? AccountResolver { get; set; }
+
     // Per-subsystem log level overrides (namespace -> level)
     public Dictionary<string, string>? LogOverrides { get; set; }