Signed into a session token by createJWT, and returned by authenticate
to the auth middleware as ctx.state.user. By then role is the user's live
role, while username is still the one at issue time.
Usage
import { type AuthPayload } from "api/model/auth.ts";