Initial commit: Usher — a Common Lisp OpenID Provider Verified

A lightweight, single-tenant OIDC provider:
- RS256 signing + self-serialized JWKS
- ID/access token issuance & alg-confusion-safe validation
- Argon2i password hashing (PHC), PKCE S256
- authorization-code grant (validate-before-consume, replay detection)
- refresh rotation with reuse detection + family revocation
- OIDC discovery, /authorize, /token, /userinfo
- pluggable store (in-memory backend); in-process TLS 1.3 via pure-tls
- 45-check fiveam test suite + .cave CI workflow

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>