fix(config): Added config.oidc.jwks_endpoint

[MisheyDev]

Added support to manually configure a JWKS endpoint w/i OIDC config.
See: #619

[pullfrog]

ℹ️ No critical issues — the wiring is correct, but the new option isn't documented.

Reviewed changes

• oidc.jwks_endpoint config option — adds an optional jwks_endpoint to both the full and partial OIDC schemas and passes it through buildOidc as the existing jwksUri field on OidcConfig.

The code change is minimal and matches the surrounding patterns exactly. provider.ts already had first-class support for a manual jwksUri (in fullManual, the discovery override, and the JWKS resolver), so this closes the gap in #619 without any behavioral risk.

ℹ️ jwks_endpoint is not documented

The new option is invisible to users, because the manual-endpoint references elsewhere in the repo weren't updated. config.example.yaml (the manual endpoints block) and docs/features/sso.md (both the "these are usually auto-discovered" list and the "Missing endpoints" troubleshooting entry) enumerate authorization_endpoint, token_endpoint, and userinfo_endpoint but omit jwks_endpoint. Since this PR's purpose is to let users supply a JWKS URL that discovery can't resolve, the option should be documented alongside the other manual endpoints.

Technical details

# Document oidc.jwks_endpoint

## Affected sites
- config.example.yaml:222-224 — manual endpoint block omits jwks_endpoint
- docs/features/sso.md:71-74 — "these are usually auto-discovered" list omits jwks_endpoint
- docs/features/sso.md:354-356 — "Missing endpoints" troubleshooting omits jwks_endpoint
- nix/options.nix:357-400 — Nix module mirrors some oidc endpoints (optional: add jwks_endpoint here too)

## Required outcome
- jwks_endpoint appears alongside the other manual endpoint overrides in config.example.yaml and docs/features/sso.md

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using DeepSeek Pro (free via Pullfrog for OSS) ｜ 𝕏}