Jwks Endpoint

Public key set for verifying plan tokens. No authentication required — this is the whole point of asymmetric signing. The omicos-admin and omicos-core boot processes hit this once at startup (and re-fetch on cache expiry, 24h default) to pick up key rotation without redeployment.