Wire Auth-o-tron 0.4 RS256 key contract

[jameshawkes]

Changelog

• Replace shared HMAC authentication with RS256 issuer, audience, and key-ID validation.
• Use Authotron chart 0.4's existing private-key Secret contract; expose only public verification keys to Polytope.
• Support overlapping public keys for staged rotation and reject inline/shared secrets.
• Add Helm assertions for key separation and invalid configurations.

Tests

• tests/run.sh against a locally packaged auth-o-tron-chart Feat/all ingress annotations in values #13
• helm lint
• helm template

Dependency gate

Depends on ecmwf/auth-o-tron#87, ecmwf/auth-o-tron-chart#13, and ecmwf/polytope-server#205. Chart/image 0.4.0 are not published yet, so Chart.lock must be regenerated from OCI after release.