Party Planner sync spike

Authenticated JSON API for one party per Clerk user. Use GET/PUT /api/party with a Authorization: Bearer <Clerk session JWT> header.

Session tokens are verified with Frontend API JWKS derived from the publishable key — CLERK_SECRET_KEY is not required for that path.