… hardening

TypeScript:
- Add ES512SignConfig interface and createES512SignConfig() factory for ECDSA
P-521 signing via the explicit API (closes #32)
- Add ES256/ES384/ES512 to all asymmetric algorithm whitelists in verify.ts
- Add JWT_JWKS_URL_NAME indirection to getJwksUrl() and envMode() (closes #33)
- Add --alg flag to keygen CLI (EdDSA|ES256|ES384|ES512) and --dotenv output
(closes #35)
- Widen JwtHeader.alg from AlgType to string (external tokens have arbitrary alg)
- Export createES512SignConfig and ES512SignConfig from index.ts

Python:
- Raise HS512 minimum secret from 32 to 64 bytes to match TypeScript
- Add mode conflict detection in env.mode() — raises RuntimeError when both
JWT_SECRET and asymmetric keys are configured
- Widen JwtHeader.alg from AlgType to str (parity with TypeScript)
- Fix and expand test suite: 5 new tests, all 29 pass

Docs:
- security-guide.md: add ECDSA cryptographic profile, update algorithm
whitelists, document keygen --alg and --dotenv flags with security rationale
- core-concepts.md: update algorithm summary, mode detection note, add ES512
and ECDSA verification rows to cross-language parity table
- cloudflare-workers.md: add "Internal JWKS via Service Binding" section
(closes #38)
- README, index.md, explicit-config.md, CLAUDE.md: reflect updated algorithm
surface and keygen CLI usage
- notes/tone-of-voice.md: update example to include ES512 alongside EdDSA

Closes #32, #33, #35, #38
Closes #34 as duplicate of #33

Written-by: Chris Lyons