Guard the fix in 4b85d24 (extractable signing keys) with tests that run the full generate → store → JWKS → sign round-trip against an empty oidc_keys table, so a future change can't silently break first-run key generation again.