Use jose instead of jsonwebtoken

jsonwebtoken hasn't been updated in two years, and its dependencies, like safe-buffer, are no longer necessary. These dependencies don't support ESM, causing errors when packaging with tools like esbuild.

```shell
> pnpm why safe-buffer
@apple/app-store-server-library 1.6.0
└─┬ jsonwebtoken 9.0.2
└─┬ jws 3.2.2
├─┬ jwa 1.4.2
│ ├─┬ ecdsa-sig-formatter 1.0.11
│ │ └── safe-buffer 5.2.1
│ └── safe-buffer 5.2.1
└── safe-buffer 5.2.1
```

jose supports ESM and has zero dependencies.

The issue names no files or tests; first locate all jsonwebtoken usage and inspect the package configuration and any existing token-signing tests. Compare those call sites with jose's API, then verify the dependency is removed and the library still packages successfully with ESM-oriented tooling.

Written by the indexing model from the issue text.