Rsa Key Service
@Service
Provides an RSA key pair for signing and verifying access tokens and exposes a stable kid. If no keys are configured, an ephemeral dev key is generated at startup.
Properties (optional):
security.jwt.rsa.public-key-pem: Base64 (PEM without headers) public key (X.509 SubjectPublicKeyInfo)
security.jwt.rsa.private-key-pem: Base64 (PEM without headers) private key (PKCS#8)
security.jwt.kid: Optional static key id; otherwise computed from public key SHA-256.