Verifies ZevAuth session tokens (RS256, keys fetched and rotated for you), reads who is signed in from a bearer token or the session-bridge cookie, calls the ZevAuth backend API with your secret key, and checks webhook signatures. Includes Rack middleware and an optional Rails engine.