
### Added
- **`GET /api/auth/verify` endpoint** — a lightweight token verification route that returns `{ valid: true, timestamp }` with a 200 status if the provided token is valid, or 401 if invalid. This is a standard protected route (not in `PUBLIC_ROUTES`), so the existing `requireAuth` middleware handles all validation. Clients can use this as a pre-flight check before committing to a WebSocket connection, enabling immediate "invalid token" feedback without the retry loop.

### Changed
- **SDK `HttpClient.verifyToken()` static method** — added a new static method that makes a one-off `GET /api/auth/verify` request without needing to instantiate a full `Jean2Client`. Returns `true` (200) or `false` (401). Throws `ConnectionError` on network failure so callers can fall through to alternative connection logic.
- **`GET /api/info` now reports dynamic auth status** — the `features.authentication` field previously always returned `true`. It now reflects the actual server configuration, returning `true` when `JEAN2_AUTH_ENABLED=true` is set, and `false` otherwise. This allows clients to determine whether authentication is required without making an authenticated request first.
