Add JWT validation test and dependency lock file

[PavelMakarchuk]

Summary

• Adds a unit test exercising the exact JWTBearerTokenValidator.authenticate_token() code path used in production — using self-signed RSA keys, no secrets, no network calls
• Adds pyproject.toml + uv.lock for reproducible builds (matching policyengine-us/uk conventions)
• Updates the production Dockerfile to use uv sync --frozen

Context

authlib 1.7.0 silently broke production JWT validation by delegating to joserfc, which rejected authlib's KeySet type in guess_key(). This wasn't caught because:

1. Integration tests use StaticBearerTokenValidator (fake token matching), never exercising the real validator
2. No lock file meant pip install pulled the latest authlib on every Docker build

Maintenance

When bumping dependencies in pyproject.toml, regenerate the lock file:

uv lock

The weekly bot PRs (policyengine-us bumps) should include this step.

Test plan

• test_authenticate_token_with_valid_jwt — confirms the keyset + validator path works
• test_authenticate_token_handles_expired_jwt — confirms expired tokens don't crash
• test_authenticate_token_rejects_wrong_key — confirms wrong-key tokens are rejected
• test_import_key_set_returns_usable_keyset — confirms JsonWebKey.import_key_set output is compatible with JWTBearerTokenValidator
• Verified: all 4 tests fail with authlib 1.7.0, pass with 1.6.11

🤖 Generated with Claude Code