fix(deps): update module github.com/lestrrat-go/jwx/v3 to v4

Migrate to jwx v4 per MIGRATION.md:
- jwk.Import now generic; use jwk.Import[jwk.Key](raw)
- Set GOEXPERIMENT=jsonv2 (v4 uses encoding/json/v2)

Dockerfile

@@ -6,6 +6,7 @@ ARG GITLAB_TOKEN
 WORKDIR /build
 ENV CGO_ENABLED=0
 ENV GOPRIVATE=gitlab.com/unboundsoftware/*
+ENV GOEXPERIMENT=jsonv2
 
 COPY go.mod go.sum ./
 RUN go mod download

auth/jwt.go

@@ -38,7 +38,7 @@ func NewJWTService(issuer, audience, adminClaim, emailClaim string) (*JWTService
 	}
 
 	// Create JWK from private key
-	key, err := jwk.Import(privateKey)
+	key, err := jwk.Import[jwk.Key](privateKey)
 	if err != nil {
 		return nil, fmt.Errorf("create JWK from private key: %w", err)
 	}
@@ -98,7 +98,7 @@ func (s *JWTService) SignToken(claims map[string]interface{}) (string, error) {
 	}
 
 	// Create JWK from private key for signing
-	key, err := jwk.Import(s.privateKey)
+	key, err := jwk.Import[jwk.Key](s.privateKey)
 	if err != nil {
 		return "", fmt.Errorf("create signing key: %w", err)
 	}