feat(relayauth): add optional product_id to JWT claims

Additive, MINOR bump. mint() accepts an optional productId, verify() surfaces it on the result without enforcing anything. Legacy tokens (no product_id) continue to validate exactly as before. Enforcement happens in downstream consumers behind a per-workspace policy flag (see cloud/specs/platform-architecture-v1.md, wave 2). No breaking change.

Author: kjgbot