fix(auth): replace unmaintained python-jose with PyJWT

Dependabot alert #25 (python-jose algorithm confusion guard bypassed by
DER-encoded public keys, CVE-2026-85394, Critical) has no patched version
of python-jose available at all - it's affected through the latest
release 3.5.0. python-jose was only used in app/dependencies.py for plain
HS256 JWT encode/decode with our own symmetric SECRET_KEY (algorithms=[...]
was already explicitly restricted on every decode call, so the specific
RS256/HS256 confusion path didn't apply here), but staying on an
unmaintained library that keeps generating unfixable critical alerts isn't
sustainable.

Swapped to PyJWT, which is actively maintained, already pulled in
transitively via msal, and a near drop-in replacement for this app's
encode()/decode() usage. Verified with a Docker build and in-container
token create/verify/reject round-trip.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

app/dependencies.py

@@ -3,9 +3,10 @@
 from datetime import datetime, timedelta
 from typing import Optional
 
+import jwt
 from fastapi import Depends, HTTPException, status
 from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
-from jose import JWTError, jwt
+from jwt import PyJWTError
 from sqlalchemy.orm import Session
 
 from app.database import get_db
@@ -56,7 +57,7 @@ def verify_mfa_token(token: str) -> str:
                 detail="Invalid MFA token.",
             )
         return username
-    except JWTError:
+    except PyJWTError:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="MFA token expired or invalid.",
@@ -95,7 +96,7 @@ def get_current_user(
                 status_code=status.HTTP_401_UNAUTHORIZED,
                 detail="Invalid token payload.",
             )
-    except JWTError:
+    except PyJWTError:
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Invalid or expired token.",