Adopt auth-o-tron RS256 client API

[jameshawkes]

Changelog

• Replace the shared HMAC secret with an RS256 public-key keyset, exact issuer checks, and the polytope-server audience.
• Fail startup on invalid verifier configuration and support overlapping keys for rotation.
• Update Rust and Python authentication fixtures for RS256, kid, issuer, and audience.
• Test against the integrated token-free Authotron 0.4 source.

Tests

• cargo fmt --all -- --check
• focused frontend and integration Clippy
• cargo test -p polytope-server
• cargo test -p polytope-server-integration-tests -- --test-threads=1
• focused Python authentication integration tests
• workspace release build and reuse lint

Dependency

Depends on ecmwf/auth-o-tron#87 at d89145401676977f30e2c6db1547ecd946ac1a14.