Verify the ID token signature using Kinde's JWKS #214

What

Verify the ID token's signature against Kinde's JWKS when handling the OAuth callback.

Why

Since #206, the callback checks the ID token's nonce, issuer, audience and expiry, but it still decodes the token with verify_signature: False. That's allowed by the OpenID Connect spec when the token comes straight from the token endpoint over TLS (which it does here), but Kinde's guidance is to verify the signature, and it's a stronger guarantee that the token really came from Kinde. Raised in review on #206: #206 (comment)

Suggested approach

• Fetch Kinde's public keys from {KINDE_HOST}/.well-known/jwks (PyJWT's PyJWKClient), and cache them so a login doesn't fetch keys every time.
• Decode the ID token with signature verification on (RS256), keeping the issuer, audience and expiry checks added in fix: stop leaking secrets through logs and session storage #206.
• If the keys can't be fetched, reject the login with a clear error rather than falling back to no verification.
• Consider using the same verification for access token claims in TokenManager, which are also decoded without verifying the signature.

Dependencies

RS256 needs the cryptography package (pyjwt[crypto]). #208 currently removes cryptography because nothing imports it today, so whichever lands second needs to add it back as pyjwt[crypto].

Tests

• A token signed with the right key is accepted.
• A token signed with a different key, an unknown kid, or alg: none is rejected.
• Keys are cached between logins.
• A failed JWKS fetch rejects the login.