feat(auth): migrate JWT from HS256 to RS256

- Add services/auth/app/config.py with JWT_PRIVATE_KEY and JWT_PUBLIC_KEY
  (Auth Service local config - private key never leaves this service)
- Update routes.py: sign tokens with RS256 private key
- Update deps.py + verify.py: verify tokens with RS256 public key
- Update shared/config.py: replace JWT_SECRET/JWT_ALGORITHM with
  JWT_PUBLIC_KEY (for optional local verification by other services)
- Add sys.path fix in main.py for local dev without PYTHONPATH

services/auth/app/deps.py

@@ -17,6 +17,8 @@ from shared.db import get_session
 from shared.models import Subscription, User
 from shared.schemas import UserProfile
 
+from app.config import auth_settings
+
 oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/v1/auth/login")
 
 
@@ -36,7 +38,7 @@ async def get_current_user(
     )
     try:
         payload = jwt.decode(
-            token, settings.JWT_SECRET, algorithms=[settings.JWT_ALGORITHM]
+            token, auth_settings.JWT_PUBLIC_KEY, algorithms=["RS256"]
         )
         user_id: str | None = payload.get("sub")
         email: str | None = payload.get("email")