Remove fallback KYC document signing key

[BigDella]

What changed

• require a dedicated KYC document URL signing key instead of auth/encryption fallbacks
• embed explicit key IDs and support a bounded previous-key rotation window
• fail closed on missing, weak, unknown, or retired keys
• document the production configuration and rotation format

Why

A public fallback literal made signed KYC document URLs forgeable in misconfigured deployments. Dedicated versioned signing keys separate this authorization boundary from session and encryption secrets.

Validation

• targeted KYC signing/config tests: 14 passed
• repository-wide typecheck still reports pre-existing failures outside this diff; no errors were reported in changed files

Closes #173

[Obiajulu-gif]

Thanks for the contribution! Merging this now as part of a maintainer PR sweep.