fix(deps): update module github.com/lestrrat-go/jwx/v3 to v4

Migrate to jwx v4 per MIGRATION.md:
- jwk.Import now generic; use jwk.Import[jwk.Key](raw)
- Set GOEXPERIMENT=jsonv2 (v4 uses encoding/json/v2)

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26@sha256:5f3787b7f902c07c7ec4f3aa91a301a3eda8133aa32661a3b3a3a86ab3a68a36 AS build
+FROM golang:1.26@sha256:46d487a9216d9d3563ae7be4ee0f6a4aa9a3f6befdf62c384fd5118a7e254c4d AS build
 
 ARG GITLAB_USER
 ARG GITLAB_TOKEN
@@ -6,6 +6,7 @@ ARG GITLAB_TOKEN
 WORKDIR /build
 ENV CGO_ENABLED=0
 ENV GOPRIVATE=gitlab.com/unboundsoftware/*
+ENV GOEXPERIMENT=jsonv2
 
 COPY go.mod go.sum ./
 RUN go mod download

auth/jwt.go

@@ -38,7 +38,7 @@ func NewJWTService(issuer, audience, adminClaim, emailClaim string) (*JWTService
 	}
 
 	// Create JWK from private key
-	key, err := jwk.Import(privateKey)
+	key, err := jwk.Import[jwk.Key](privateKey)
 	if err != nil {
 		return nil, fmt.Errorf("create JWK from private key: %w", err)
 	}
@@ -98,7 +98,7 @@ func (s *JWTService) SignToken(claims map[string]interface{}) (string, error) {
 	}
 
 	// Create JWK from private key for signing
-	key, err := jwk.Import(s.privateKey)
+	key, err := jwk.Import[jwk.Key](s.privateKey)
 	if err != nil {
 		return "", fmt.Errorf("create signing key: %w", err)
 	}