Add ES256 federation support and JWT config caching: - DID-based key fetcher for verifying tokens from any PDS - O(1) issuer whitelist lookups with cached config - Environment configuration documentation 🤖 Generated with [Claude Code](https://claude.com/claude-code)