Phase 2 backend: Google Wallet pass + profile contact form

- cardclaws-wallet::google — inline GenericObject + RS256 `savetowallet` JWT
  (Rs256Signer via jsonwebtoken; FakeGoogleSigner test double)
- POST /v1/cards/{id}/wallet/google → { saveUrl }
- POST /v1/profile/{handle}/contact — validate, rate-limit, record
  contact_form_submission, email the owner (HTML-escaped, Resend)
- WalletConfig gains google issuer id + service account email

84 backend tests; fmt + clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

cardclaws-backend/crates/cardclaws-wallet/Cargo.toml

@@ -23,6 +23,10 @@ sha1 = { workspace = true }
 zip = { workspace = true }
 image = { workspace = true }
 thiserror = { workspace = true }
+# Google Wallet "save" JWT (RS256). jsonwebtoken is pure-Rust, so this is always
+# compiled (unlike the openssl-backed Apple signer).
+jsonwebtoken = { workspace = true }
+base64 = { workspace = true }
 openssl = { version = "0.10", features = ["vendored"], optional = true }
 
 [dev-dependencies]