A JWKS rotation succeeds and one edge tier still rejects valid tokens

The new keys are published, yet one app path reuses a stale cache entry created from a different JWKS URL under the same issuer host.