fix: preserve kid in JWKS endpoint output (#581)

python-jose's to_dict() doesn't include the kid field from the
original JWK. this fix explicitly copies the kid from the input
JWK to the public key output.

the kid is required by ATProto OAuth for key identification when
validating client assertions.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.5 <[e-mail]>

backend/src/backend/_internal/auth.py

···
         public_jwk["use"] = "sig"
         public_jwk["alg"] = "ES256"
 
+        # preserve kid from original JWK (python-jose's to_dict() doesn't include it)
+        if "kid" in jwk_data:
+            public_jwk["kid"] = jwk_data["kid"]
+
         return {"keys": [public_jwk]}
 
     except Exception as e: