Persistent JWT Signing Keys with PostgreSQL

The previous article ended with this caveat: In production, replace createInMemoryKeyStore() with a persistent store backed by a database or secrets manager so keys survive restarts. This article does exactly that. We'll swap the in-memory key store for two PostgreSQL-backed implementations: A JwksKeyStore that stores private keys with envelope encryption (AES-256-GCM, DEK + KEK) and public keys as plain JSON. A JwksRotationTimestampStore that derives the last rotation time directly from the key