add key rotation to jwks endpoint

[lecafard]

Add key rotation to the JWKS endpoint using a deterministic half-epoch sliding window. With the epoch set to 1 week (7 days), the rotation follows this timeline:

• Day 0 to 3.5: Keys for Epoch 0 and 1 are published. We sign using Epoch 0.
• Day 3.5 to 7: Keys for Epoch 0 and 1 are published. We sign using Epoch 1.
• Day 7 to 10.5: Cache rotates. Keys for Epoch 1 and 2 are exposed. We sign using Epoch 1.
• Day 10.5 to 14: Keys for Epoch 1 and 2 are exposed. We sign using Epoch 2.
• Day 14...: Cache rotates. Keys for Epoch 2 and 3 are exposed. We sign using Epoch 2.