fix: Retry JWKS fetch on signature failure for key rotation

When Clerk rotates signing keys, the cached old public key can't verify
tokens signed with the new key. Instead of immediately failing, evict
the stale cached kid, re-fetch JWKS, and retry decode once. Only applies
to remote key mode (secret_key); user-provided jwt_key still fails
immediately.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>