Summary

• HMAC JWKS (HIGH): JWKS endpoint no longer exposes HMAC symmetric keys. Only asymmetric public keys (RSA/ECDSA) are published. Exposing HMAC keys would allow anyone to forge valid JWTs.
• Redirect URI wildcard (MEDIUM): Fixed regex so *.example.com only matches proper subdomains (sub.example.com) and not evil-example.com.

Files Changed

• internal/http_handlers/jwks.go — filter out HMAC keys from JWKS response
• internal/validators/url.go — fix wildcard subdomain regex boundary

Test plan

• make test-sqlite passes (no regressions)
• Verify JWKS endpoint returns empty keys for HMAC-only config
• Verify *.example.com matches a.example.com but rejects evil-example.com