feat: issue signed enforcement tokens

[tuzuminami]

Summary

• issue short-lived Ed25519 JWS enforcement tokens only for VEIL ALLOW decisions
• publish rotation-aware JWKS, public input-hash helpers, and AuthZEN enforcement token output
• require signing material in production and keep bearer tokens out of persisted decisions and idempotency records

Verification

• pnpm run verify (75 passed, 5 PostgreSQL integration tests skipped without a database)
• Sol correctness and security review findings remediated before this PR.

Closes #33