Add thin Central proxy + JWKS-based bench↔Central auth

Central billing client and site-billing admin routes with JWKS authentication; usage meters composed server-side.