feat: add issuer claim and RFC 8414 metadata endpoint

[paullatzelsperger]

Summary

• Issued tokens now carry an iss claim identifying jwtlet as the authorization server (previously empty). The issuer is jwtlet itself, not the subject token's original issuer (which remains in act.iss) and not Vault, whose transit engine is only the signing primitive.
• Adds a new top-level issuer config value (required, must be a valid URL), wired into TokenExchangeService and validated at startup.
• Exposes an RFC 8414 authorization server metadata document at GET /.well-known/oauth-authorization-server on the token-exchange port (default 8080), advertising issuer, token_endpoint, jwks_uri, grant_types_supported, and token_endpoint_auth_methods_supported.

Changes

• jwtlet-core: TokenExchangeService gains an issuer field; issued TokenClaims now set iss.
• jwtlet-server: new meta module with AuthorizationServerMetadata + handler; route registered on the exchange API; issuer added to config with validation; assembly/main wiring.
• e2e manifest: top-level issuer added to jwtlet-config.yaml.
• e2e tests: new metadata.rs verifying the metadata document contents and the JWKS endpoint.