feat(auth): migrate JWT from HS256 to RS256

- Add services/auth/app/config.py with JWT_PRIVATE_KEY and JWT_PUBLIC_KEY
  (Auth Service local config - private key never leaves this service)
- Update routes.py: sign tokens with RS256 private key
- Update deps.py + verify.py: verify tokens with RS256 public key
- Update shared/config.py: replace JWT_SECRET/JWT_ALGORITHM with
  JWT_PUBLIC_KEY (for optional local verification by other services)
- Add sys.path fix in main.py for local dev without PYTHONPATH

services/auth/app/verify.py

@@ -19,6 +19,8 @@ from shared.config import settings
 from shared.db import async_session
 from shared.models import Subscription
 
+from app.config import auth_settings
+
 router = APIRouter(tags=["auth"])
 
 
@@ -37,7 +39,7 @@ async def verify(request: Request) -> Response:
 
     try:
         payload = jwt.decode(
-            token, settings.JWT_SECRET, algorithms=[settings.JWT_ALGORITHM]
+            token, auth_settings.JWT_PUBLIC_KEY, algorithms=["RS256"]
         )
         user_id: str | None = payload.get("sub")
         email: str | None = payload.get("email")