Add ATProto service-auth JWT helpers #10

From atmos/serviceauth: add helpers for ATProto inter-service JWTs: create short-lived tokens with iss/aud/exp/iat/jti and optional lxm, verify audience/time/lex method, resolve issuer DID signing key, and retry once on key rotation if identity cache support exists.