Add GET /api/keys/public route for grant signature verification

[Copilot]

GrantVerifier.fetchPublicKey() fetches the server's Ed25519 public key from GET /api/keys/public to verify JWS grant signatures, but that route didn't exist — making client-side grant verification always fail with a 404.

Changes

• Service interface — added keys.getPublicKey(): Promise<string> returning SPKI PEM
• LocalService — stores publicKey: KeyObject in deps; exports it as SPKI PEM via keys.getPublicKey(); resolveService now destructures both keys from loadOrGenerateKeyPair
• RemoteService — implements keys.getPublicKey() by proxying to GET /api/keys/public
• routes.ts — adds the missing route, auth-protected by the existing bearer middleware:

fastify.get('/api/keys/public', async () => {
  const publicKey = await service.keys.getPublicKey().catch(handleError)
  return { publicKey }
})

• Tests — updated LocalService constructor calls in service.test.ts and client-server-flow.test.ts; added mock and route tests in routes.test.ts

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.