fix: Add jwks_uri to HuggingFace OAuth config

SUCCESS: Session cookie now persisting! Cookie has Secure + SameSite=None.
Browser sends cookie on callback, session data survives redirect.

NEW ISSUE: OAuth fails with Missing jwks_uri in metadata
FIX: Add jwks_uri parameter to OAuth registration

src/services/auth_service.py

@@ -34,6 +34,10 @@ class AuthService:
             "HF_USERINFO_URL",
             "https://huggingface.co/oauth/userinfo"
         )
+        jwks_uri = os.getenv(
+            "HF_JWKS_URI",
+            "https://huggingface.co/oauth/jwks"
+        )
 
         # Register OAuth provider (HuggingFace or mock)
         # HF Spaces provides OAUTH_CLIENT_ID/SECRET when hf_oauth: true
@@ -48,6 +52,7 @@ class AuthService:
             authorize_url=authorization_url,
             access_token_url=token_url,
             userinfo_endpoint=userinfo_url,
+            jwks_uri=jwks_uri,
             client_kwargs={"scope": "openid profile email"},
             # Set update_token to None to avoid unnecessary token updates
             update_token=None,