🐛 fix(auth): use Better Auth native JWT validation with EdDSA

- Replace jsonwebtoken RS256 validation with jose EdDSA
- Add JWKS endpoint to expose Better Auth public keys
- Use createRemoteJWKSet for token validation
- Fix issuer mismatch (use env var consistently)
- Add jwks table to schema for Better Auth JWT plugin
- Install jose library for JWT verification

services/mana-core-auth/src/auth/auth.controller.ts

@@ -126,6 +126,17 @@ export class AuthController {
 		return this.betterAuthService.validateToken(body.token);
 	}
 
+	/**
+	 * Get JWKS (JSON Web Key Set)
+	 *
+	 * Returns public keys for JWT verification.
+	 * This is a passthrough to Better Auth's JWKS.
+	 */
+	@Get('jwks')
+	async getJwks() {
+		return this.betterAuthService.getJwks();
+	}
+
 	// =========================================================================
 	// B2B Registration
 	// =========================================================================