refactor(local-identity): post-Stage4 cleanups and micro-fixes

- audit: chmod only on file creation, not every append (TOCTOU fix)
- jwt_utils: add extract_unverified_payload() helper
- cli: use extract_unverified_payload + JWTError instead of inline decode
- keys: extract _public_key_bytes() helper, import _b64url from jwt_utils
- security: FileNotFoundError try/except instead of path.exists() (TOCTOU fix)
- serve: cache JWK response at server init instead of per-request recompute

138 tests passing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

local-identity/src/local_identity/security.py

@@ -24,9 +24,10 @@ class CheckResult:
 
 def _check_mode(path: Path, expected: int) -> CheckResult:
     """Return a CheckResult for a single path against the expected mode."""
-    if not path.exists():
+    try:
+        actual = stat.S_IMODE(os.stat(path).st_mode)
+    except FileNotFoundError:
         return CheckResult(str(path), "warn", "does not exist (skipped)")
-    actual = stat.S_IMODE(os.stat(path).st_mode)
     if actual != expected:
         return CheckResult(
             str(path), "fail",