docs: add CLAUDE.md agent guidelines for node-oauth2-jwt-bearer

[jd3vi1]

Summary

Adds AI-agent guidelines for node-oauth2-jwt-bearer — a lean, guardrail-first CLAUDE.md plus a thin AGENTS.md that points to it, generated by the generating-claude-md skill and validated against the repo. This is a monorepo, so per the skill's current single-root-file behavior it ships one root CLAUDE.md covering the repo and its packages.

• CLAUDE.md (151 lines) — persona, working principles, project overview/structure, three-tier Boundaries, Security, and one-line anchors into references/.
• AGENTS.md — imports @./CLAUDE.md so non-Claude tools (Codex CLI, Gemini CLI) share the same guidance.
• references/*.md — full detail offloaded on demand: commands, testing, code-style, git-workflow, pitfalls, docs-update.

What detection surfaced (node-oauth2-jwt-bearer specific)

• npm-workspaces monorepo — three layered packages (oauth2-bearer → access-token-jwt → express-oauth2-jwt-bearer) plus examples; only express-oauth2-jwt-bearer (v1.9.1) is published. Structure section and root scripts (test/lint/build run --workspaces) reflect this.
• API-side JWT validator → no telemetry — this library only verifies JWTs and fetches JWKS; it sends no Auth0-Client header. Per the skill's telemetry rules (shape 4), the telemetry boundary is intentionally omitted, and Security says so explicitly.
• Security posture — signature/issuer/audience verification via jose, an enforced algorithm allowlist (none rejected), and DPoP proof validation (dpop-verifier.ts) → documented in Security, not the persona.
• Jest with a 100% coverage threshold (jest.config.js, all packages) → surfaced as an Always-Do boundary and a pitfall; lowering it is Ask-First.
• Cross-package testing — tests import siblings by name via Jest moduleNameMapper + ts-jest paths (resolve to src/, no build needed) → captured in testing + pitfalls.
• Two build tools — internal packages use tsc; the published package bundles with Rollup (rollup.config.mjs) → noted in commands + pitfalls.
• Code style — per-package .eslintrc (@typescript-eslint recommended) + Prettier (singleQuote, printWidth: 80); RFC 6750 typed error hierarchy (InvalidTokenError, InsufficientScopeError, ...) as the error convention.
• Docs mapping (library shape) — the published package's exports/options map to its README.md / EXAMPLES.md / examples/; CHANGELOG.md and generated docs/ (TypeDoc) intentionally not tracked.

Validation

Filesystem validation pass: every cited path, every package.json script / CI job, and every references/*.md pointer (6/6) verified to exist in the repo — no invented tooling.

Generated by the generating-claude-md skill.