I fixed up auth-service-lib before jumping into workspace-service. I added AuthenticatedUser
so other services can just use @AuthenticationPrincipal instead of digging through
SecurityContext manually. also fixed some stuff in JwtTokenCandidate that was
technically wrong but worked anyway lol