JSON Web Key Set for JWT verification

The platform middleware fetches this to verify JWT signatures locally without per-request MudraID calls. Returns every key currently considered valid for verification — that is, the active signing key plus any previous (rotated-but-not-retired) keys.

Cache hint: middleware should cache for ~1 hour and refresh immediately on encountering an unknown kid. The endpoint sets Cache-Control: public, max-age=3600.