fix(api): catch remaining JWKS mutation survivors (#130)

[tradem]

Summary

Fixes the six surviving mutation-testing mutants in CachingJwksProvider from issue #130.

• Use Tokio's monotonic clock for deterministic cache-TTL tests.
• Add a local Axum JWKS server fixture with RSA signing, encryption, non-RSA, and missing-kid keys.
• Verify that only the valid RSA signing key is accepted and that it can validate an RS256 token.
• Test cache reuse, exact TTL expiry, and post-expiry refresh.
• Decode RSA JWK components as raw bytes and enable jsonwebtoken's RustCrypto backend explicitly.
• Add the systematic implementation plan to docs/issues/remaining-6-jwks-mutants.md.

Validation

• cargo fmt --all -- --check
• cargo test -p api
• cargo clippy -p api --all-targets -- -D warnings
• cargo mutants -p api -f crates/api/src/auth/jwks.rs
  • 19 mutants tested
  • 13 caught
  • 6 unviable
  • 0 missed

Acceptance criteria

• The six TTL and JWK-filtering mutants are caught locally.
• The CI mutation-testing PR gate will provide the final mutate-security verification.

Co-authored-by: gpt-5.6-luna (opencode-go)