[fix] Bound issuer key caching

[St4NNi]

Closes #345

Unverified JWT claims selected the issuer key, which was parsed and inserted into an unbounded process-lifetime cache before any trust check — an unauthenticated memory-exhaustion vector.

• A trust gate runs before caching: only a trusted realm (with a valid delegation signature over the issuer pubkey) reaches the cached path; untrusted issuers decode with an ephemeral, never-cached key.
• Both caches (API ServerState and the metadata validator) are replaced by one bounded IssuerKeyCache (LRU 1024 entries + 1h TTL).