Server-side helpers for integrating with Patchwork: RS256 session tokens, HMAC request signing and verification, webhook signature verification, and Rack middleware for hosted tool calls. This is the inbound half — everything Patchwork sends you, and the credentials you hand it. A client for calling the Patchwork API arrives in 0.2.