fix(hub): JWKS warm should not block port binding

[finedesignz]

Summary

• Boot-time `warmJwksCache()` was calling `process.exit(1)` on failure, taking down every Coolify deploy because the upstream Keygen JWKS endpoint `/v1/accounts/{ACCOUNT_ID}/.well-known/jwks.json` returns 404 on this self-hosted instance.
• The hub serves many surfaces that don't need Titanium JWT verification (health, public webhooks, SPA, scheduler, agent WS). A stalled Titanium endpoint should never block port bind.
• Auth-gated routes already fail closed at request time via `verifyLicenseJwt`, which lazy-warms through `jose`'s `createRemoteJWKSet` on first use. So switching the boot gate to log-and-continue is safe.

Why this is urgent

Blocks PR #60 (started_at scheduler fix) from reaching production before the midnight 4h cron fires.

Verification

Probed `https://keygen.titaniumlabs.us\` directly:

• `/v1/accounts/{ACCOUNT_ID}/.well-known/jwks.json` → 404
• `/v1/accounts/{ACCOUNT_ID}` → 401 (account exists, auth required — confirms host/id correct)
• `/.well-known/jwks.json`, `/jwks`, `/jwks.json`, `/public-key`, `/.well-known/openid-configuration` → all 404

Keygen self-hosted does not expose a JWKS endpoint at any standard path. A follow-up should investigate the correct license-key distribution mechanism (likely RSA/ED25519 public key via account metadata), but production cannot wait.

Test plan

• Hub starts even when `TITANIUM_KEYGEN_API_URL` points at a 404 JWKS path
• Warn line printed to logs on warm failure
• License-gated routes still fail closed when JWKS unavailable at verify time (existing behavior via `verifyLicenseJwt` → `createRemoteJWKSet`)
• Post-merge: confirm Coolify deploy comes up, scheduled-task started_at fix from fix(scheduler.registry): ensure started_at always populated on cron fires #60 is live

🤖 Generated with Claude Code