feat(security): implement safe guest auth flow and harden request_jwt

- Patched request_jwt to strip privileged IDs when signing with public keys
- Updated AccountContext and V3 dependencies to preserve JWT payloads for guests
- Whitelisted Archive, Post, Event, and other core objects for public read access
- Added 'default_qry_str' to Event searchable fields
- Added test_e2e_jwt_guest_auth.py for security verification

app/models/auth_models.py

@@ -11,3 +11,4 @@ class AccountContext(BaseModel):
     manager: bool = False
     super: bool = False
     auth_method: str = 'legacy_header'
+    token_payload: Optional[dict] = None