Add key signing rotation; JWKS alg, RSA cert signing

[matoszz]

• Token signing keys now rotate automatically off certificate lifetimes - the signer with the most remaining validity wins, new keys wait for JWKS propagation before signing, and no key signs tokens it can't outlive
• Rotation happens live in the running server with no restart, no dropped sessions, and no stale JWKS (knocks on wood) - consumers holding the token manager see new keys immediately, and failed reloads retry with backoff
• Public keys of retired signers are archived in redis and served for verification across all deployment replicas, so tokens signed before a rotation keep verifying until they naturally expire
• Existing tokens and sessions survive the upgrade with zero config: keys named by the old ULID convention keep verifying under the kid embedded in outstanding tokens, in either deploy order between infra and core
• Key identity now derives from the key material itself (RFC 7638 thumbprint) rather than filenames, so kids stay stable no matter how or where keys are mounted

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
73.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud