chore(release): v1.21.0

[ovander]

What and why

Release cut for v1.21.0:

• moves the [Unreleased] section of CHANGELOG.md under [1.21.0] - 2026-10-05, with a release summary, and adds the compare links;
• bumps the version pinned in the README install snippet.

The release contains jwtauth.WithTenantClaim (#86). It lets apps read the tenant from Socrate's namespaced claim, https://socrate/tenant_id; without it, httpware.RequireTenant refused every Socrate token. Requested by Lakebridge on go-oauth2 #308.

How it was tested

The cut changes only documentation. The code it releases was tested and passed CI in #86.

• go mod tidy && git diff --exit-code go.sum leaves go.sum unchanged (no dependency change)
• go build ./... passes
• go vet ./... passes (in feat(jwtauth): WithTenantClaim names the claim the tenant is read from #86)
• go test -race -count=1 -timeout=120s ./... passes (in feat(jwtauth): WithTenantClaim names the claim the tenant is read from #86; CI runs it again here)
• golangci-lint run ./... (v2.14.0) reports no issue (in feat(jwtauth): WithTenantClaim names the claim the tenant is read from #86)
• govulncheck ./... reports no vulnerability (CI, feat(jwtauth): WithTenantClaim names the claim the tenant is read from #86)
• CHANGELOG.md updated (release section)

Compatibility

• Exported-API change: additive only. New jwtauth.WithTenantClaim(name string) Option, from feat(jwtauth): WithTenantClaim names the claim the tenant is read from #86.
• Behaviour change for existing callers: none; the default still reads tenant_id.
• Breaking change: none.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GKRxaeYxyDhmt42cehLsGA

---

Generated by Claude Code