feat(headless-login): add jwks cache visibility and refresh flow

- replace inline headless jwks support with jwksUri-only validation
- add cached jwks refresh worker, manual refresh/revoke endpoints, and parsed key summaries
- expose allowed algorithms and key previews in DevFront with regression coverage

backend/internal/domain/hydra_models.go

@@ -28,9 +28,8 @@ type HydraClient struct {
 }
 
 func (c *HydraClient) SupportsHeadlessLogin() bool {
-	// A headless login client must have a public key registered (URI or Inline)
-	// and use private_key_jwt for token endpoint authentication.
-	hasPublicKey := c.HeadlessJWKSURI() != "" || c.HeadlessJWKS() != nil
+	// Headless login now supports jwksUri only.
+	hasPublicKey := c.HeadlessJWKSURI() != ""
 	isPrivateKeyJwt := c.HeadlessTokenEndpointAuthMethod() == "private_key_jwt"
 	return hasPublicKey && isPrivateKeyJwt
 }