JWKS key rotation reaches the web tier but one API pod still caches the old signer

Login works on some paths, yet token validation fails intermittently because one long-lived process never refreshed the current signing keys.