Add `jwks_uri` to the OAuth 2.1 authorization-server metadata (RFC 8414 RECOMMENDED) and serve an empty JWKS at `/oauth/jwks`. The key set is empty because Cirrus signs access tokens with HS256 (symmetric `JWT_SECRET`), so there are no public keys to publish — but OAuth clients commonly run JWKS discovery against the metadata regardless, and the reference atproto PDS publishes the same empty document for ecosystem compatibility.