feat(aura): onboarding.first_use (+25) hook in JWT-Branch

Cross-App-Hook nach Pageta-Pattern. context.app='wordeck' im Payload.
Bewusst NICHT im dev-stub-Branch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/api/src/middleware/auth.ts

@@ -1,5 +1,6 @@
 import type { Context, MiddlewareHandler } from 'hono';
 import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { fireFirstUseOnce } from '../services/aura-client.ts';
 
 /**
  * Auth-Middleware der Cards-API (Phase 2 Auth-Föderation).
@@ -81,6 +82,9 @@ export const authMiddleware: MiddlewareHandler<{ Variables: AuthVars }> = async
 			c.set('userId', claims.sub);
 			c.set('tier', claims.tier);
 			c.set('authMode', 'jwt');
+			// Cross-App-Aura-Hook: erste Wordeck-Aktion → 25 Aura einmalig.
+			// Reason-Katalog: mana/docs/playbooks/AURA_PER_APP_HOOKS.md.
+			fireFirstUseOnce(claims.sub);
 			await next();
 			return;
 		}