JWKS endpoint fetching with caching and rotation

[shaneutt]

Periodic JWKS (JSON Web Key Set) fetching from a configured endpoint with caching and key rotation handling.

Requirements

• Fetch JWKS from configurable endpoint URL
• Cache keys with configurable TTL
• Periodic background refresh before TTL expiry
• Handle key rotation: new keys appear, old keys disappear
• Support key lookup by kid (Key ID)
• Retry with backoff on fetch failures

Implementation Notes

• Background async task for refresh
• Graceful degradation: use cached keys if refresh fails
• TLS verification on JWKS endpoint

Parent epic: #12